Reliable way to permanently hide primary email address [closed]

Question

I'd like to permanently hide my primary email address by using a permanent forward email address/alias for an extra layer of security. My plan is:

1. Creating a new personal email address.
2. Create a forward email alias (DuckduckGo email protection is the best choice I found so far, I can create a @duck.com email alias and send and receive emails through it).
3. Change all of my current and future registrations/use only my forward email address. Ps: for unreliable websites, I could still use disposable email addresses.

My question is, how reliable do you think this is for the long term? E.g.: what if DDG or another forward email service I'm using, suddenly stops supporting this service?

Answer 1

I don't have any opinion on the service you asked about specifically, as I've never used it. From a technical/ infosec perspective, by placing any sort of proxy in front of your primary email address you're basically setting up a new email address, and then encouraging everyone to use that to reach you instead of your existing one. Your comms are now flowing through two endpoints!

I propose a slightly different approach. Consider these different contexts in your life, and have different email addresses (plural) for them:

1. orgs that deal in your identity, eg. isp/ bank/ service providers/ trading platforms/ income-related/ government and municipal/ etc.

2. loved ones and people that know you personally and "in real life"

3. orgs that don't "need to know", but with which you will have (hopefully) friendly relations, that will have at least some of your details, eg. subscription services/ buy-sell platforms/ websites like this one/ etc.

4. orgs that you know will actively abuse your relationship or the information, that you wish to know as little about you as possible (ps. they don't care when your birthday is... so don't tell them your date of birth)

I'm assuming you still have your existing email account, eg. [email protected] which is a little too close to home for entities in groups 3 and 4, but over time you'd like to continue to use this account for entities in groups 1 and 2.

As you know group 4 is easy to deal with as long as they have none of your details. Services like 10minutemail.net or temp-mail.org work, so does [email protected]!

Privacy-oriented email service

You could use a (hopefully reputable) privacy-preserving email service provider, for example Protonmail, Tutanota, or the like JNakutavičiūtė'22.

Hosting and domain-name

Another option is setting up shop on a hosting service with your own domain-name, which will allow you to have multiple accounts that you can then manage independently through a single interface.

In this case, be sure not to leave a treasure-trove of email on the server. Ensure strong passwords on every account. Consider getting this hosting in your legal jurisdiction if you can, especially if you've instructed entities in group 1 to contact you via this channel.

This option comes with a cost, but this is really the best way to ensure longer-term viability... worst case, with the domain name you can just transfer from one service provider to another and re-establish the various accounts.

Ensure TLS for email delivery

You can audit any email service provider's smtp servers to make sure they allow (or force?) the use TLS for delivery of incoming email, eg: ssl-tools.net for @duck.com:

This is a good idea because, while you have no control over what others do, most email service providers will configure their systems to ensure transport-layer encryption as long as the receiving end allows for it.