Email privacy without disposable addresses means one alias per relationship on a domain you own, so you can disable a leak without throwing away your identity. That is not anonymity. It is containment. MailerZ named aliases, HOLD unknown, exclusive MX, intact Header From. When a shop leaks, disable shop-x@, not your human Gmail. No catch-all FORWARD. No inboxing percentage. No stealth promise.
Quick answer for email privacy non disposable alias
Privacy here is blast-radius control.
RFC 5321 still shows your domain on From when you send-as.
Disposable addresses optimize for walking away from the domain too. Long-term strategy keeps the domain.
HOLD unknown so the world cannot invent aliases into your Gmail.
One alias per shop beats plus-addressing you cannot revoke at the domain.
Start free with three well-chosen names.
Authoritative mail transport is defined in IETF RFC 5321 — Simple Mail Transfer Protocol. Product path: email alias service, custom-domain email alias, and aliases and catch-all.
User problem and decision criteria
Decision criteria: which relationships deserve a name, who can disable, leftover MX.
If you wanted to hide from the shop, you wanted a mask app.
If you wanted to keep hello@ forever, you wanted forwarding.
Agencies should not call this anonymity.
Public figures: more named aliases, still HOLD.
No HIPAA.
No SOC 2 as privacy.
Kids plus catch-all is the opposite of privacy.
Technical mail flow
Give shop-x@ → leak → disable shop-x@ → Gmail stays → hello@ stays.
Catch-all makes every guess a leak surface.
Send-as as hello@ is a paid identity. Do not send-as a leaked shop alias after disable.
History shows the firehose until disable.
Step-by-step setup / decision path
- List relationships to isolate.
- Create named aliases up to plan limits.
- HOLD unknown.
- Exclusive MX.
- When leaked, disable and replace if needed.
- Do not FORWARD to “see who still has it.”
- Keep human inbox off the website.
- Review the list yearly.
Classify the next failure before a second DNS edit.
HOLD unknown unless you wrote a FORWARD reason.
Quote live pricing before promising alias counts.
Failure modes and proof
Catch-all as privacy.
Disposable provider as long-term brand.
Stealth claim.
Printed personal Gmail.
Unrevoked send-as on a leak.
Self-send.
Inboxing.
Header rewrite.
Open relay.
No disable path.
Leftover MX.
Infinite public names.
MailerZ workflow and product boundary
MailerZ is custom-domain aliasing and forwarding with optional paid send-as. Secuno LLC operates mailerz.net. The app is mail.mailerz.net. Not Workspace, not IMAP, not an open relay, not a campaign ESP.
Envelope SRS only. Header From, Subject, Date, Message-ID, body, and MIME stay intact. Exclusive MX. Hold unknown on Free. Copy SMTP host, port, and TLS or STARTTLS from the dashboard when you send.
Free: one domain, three aliases, one seat, fourteen-day store, fifty outgoing a month, no send-as. Solo forty dollars a year, fifteen aliases, ninety-day store, one hundred outgoing, five send-as per hour. Starter eight or eighty. Business nineteen or one hundred ninety. Agency thirty-nine or three hundred ninety. Quote pricing. No SOC 2, ISO, HIPAA, SLA, or inboxing percentage.
Cost, alternatives, and trade-offs
A disable is cheaper than a new Gmail.
A new domain every leak is expensive theater.
HOLD is cheap.
Mask apps are cheap for true throwaways—keep them off the brand.
Agencies: containment as a privacy story that is honest.
No fake anonymity premium.
Solo vs seats.
No inbox KPI.
Operational depth
Name aliases after the relationship, not after the year. Years pass. Shops remain.
A yearly review disables dead shops. That is hygiene.
HOLD review is part of privacy: guesses do not arrive.
Teach family the same on a personal domain.
Security page for enterprise wording.
Do not evade site ToS with clever local-parts as a strategy we endorse.
Quote Solo when three names are not enough.
Probe after disable that the old string stops.
Keep ESP off isolated aliases.
Registrar lock still matters. Privacy dies if NS dies.
Offboard people who can create aliases.
Write the strategy in one paragraph in the brand guide.
Field notes for long-term privacy without disposables
Containment is the strategy. You keep the domain. You keep the human inbox. You cut the leaked string. That is not anonymity. Sites can see your zone. MX is public. WHOIS is a registrar topic. MailerZ will not hide that you have a website. If you needed to disappear, you wanted a mask app and you accepted blocklists.
One named alias per relationship you care to isolate. Shop-x@ for a store, travel-y@ for an airline, bank-z@ only if you will staff it. When shop-x leaks, disable it. Gmail stays. hello@ stays. Plus-addressing on Gmail cannot be revoked at a zone you do not operate. Domain aliases can.
HOLD unknown is the privacy control most people skip. Catch-all FORWARD makes every guess a leak surface and trains junk. The internet will invent admin@ and office@ on a personal zone. Those should not arrive. Review held mail on a schedule. Create a named alias only when a real relationship appears.
Do not print your personal Gmail on the site. That creates a future migration and a blast radius the size of your life. A stable hello@ on your zone is the public contract. Individual first@ aliases can exist for family. They are still not catch-all.
Yearly review disables dead shops. Privacy decays when nobody retires strings. A list in a password manager next to the login is enough. Agencies can sell this review as a hygiene hour.
Send-as as hello@ is a paid identity. Do not keep sending as a leaked shop alias after you disable inbound. Rotate SMTP if that identity’s secret leaked. Copy dashboard values. Free has no send-as.
Exclusive MX so disable is complete. Leftover builder MX means some senders still reach a host you forgot. Two resolvers after every change. Registrar lock still matters. Privacy dies if NS dies.
Kids: do not enable catch-all so they can invent addresses. That is a safety and junk problem. Named aliases you chose, HOLD for the rest.
Do not endorse ToS evasion. Clever local-parts to dodge a site’s rules are not a strategy this page sells. Containment is for leaks you did not choose.
Enterprise wording stays honest. No HIPAA. No SOC 2. Security is the control page. Inboxing is not privacy. A folder is not a contain.
If a relationship is truly throwaway and you will never need to be found, a mask app is cheaper than burning a brand local-part. Keep those off the company zone. Two aisles. See the privacy-versus-forwarding distinction: durable strings here, burnable strings there.
Quote Solo when three names are not enough. Free is one domain and three aliases. Do not invent unlimited as a privacy feature. Check pricing.
Probe after disable. Confirm the old string stops arriving. Confirm the replacement works from a third mailbox. Self-send lies about both.
Write the strategy in one paragraph in the brand or family guide: named per relationship, HOLD, disable leaks, keep the human inbox, exclusive MX, yearly review. Future you at 11 p.m. should not “improve” it into catch-all.
A new domain every leak is expensive theater. The long-term move is a map you can cut. Own the zone. Auto-renew it. That is more privacy than a pile of disposables you cannot find in five years.
Offboard people who can create aliases. Random new public names are a privacy leak of a different kind. Production access includes the alias map.
Worked scenarios for containment privacy
A shop leaks shop-x@. You disable it. You create shop-x2@ only if you still order there. You update the account email. Gmail never changed. hello@ never changed. That is the strategy working. A disposable provider would have you walk away from a domain you do not own. Long-term you own lastname.com or the company zone.
Catch-all FORWARD “for privacy so I can see who has my name.” Every guess arrives. Junk trains. Harassment arrives. HOLD was the privacy control. You disable FORWARD. You create named aliases for the three relationships that were real in the held list. The rest stay held.
Personal Gmail on the company site. A leak is your life. You add hello@ on MailerZ, exclusive MX, update the site, keep Gmail as the store. You do not buy a new Gmail. You contain the public string.
Plus-address you+shop@gmail.com cannot be revoked at the shop. The shop has the plus tag forever. A domain alias can be disabled. That is why plus is not the long-term system.
Family domain. Parent enables catch-all so kids can invent. Scanners invent too. HOLD plus parent-chosen names. Safety and privacy are the same motion here.
Yearly review. Twelve shop aliases. Four unused. Disable the four. Probe that they stop. Password manager list stays the source of truth. This hour is cheaper than a new domain.
Founder wants stealth from a journalist form. That is a mask app or a lawyer, not MailerZ. You say the zone is public MX. You do not fake Google MX. Leftover MX is not privacy. It is a split.
Send-as as hello@ after a shop leak. You do not send as the leaked shop string. You rotate if that SMTP user was the shop identity. Dashboard copy. Free has no send-as.
Enterprise asks if containment is HIPAA. No. Store is fourteen or ninety days. Not an archive. Security page. Counsel if they need a real hold. Do not mint a vault.
Agency writes “anonymous email” in a proposal for a brand zone. You strike it. Containment, not anonymity. Two-year strings on MailerZ. Throwaways on a mask app. Exclusive MX on the brand only.
Leftover builder MX after a “privacy setup.” Some shops still reach the builder. Disable on MailerZ does nothing for those senders. Two resolvers. Delete leftovers. Privacy requires exclusivity.
Someone mints twenty public brand names in a week for “privacy.” You now have twenty disable jobs and a messy footer. Short public list. Isolate shops, do not clone the company into twenty public nouns.
Probe after disable from a third mailbox. Old string should not arrive. Replacement should. Self-send can lie about both. Message-IDs in the note next to the vendor update.
Auto-renew the domain. A lapsed zone is a hijack and a privacy failure. Registrar lock. Recovery mailbox that is not the public hello@. The long-term strategy includes still owning the name in 2030.
Practice and anti-patterns for containment privacy
Anti-pattern: catch-all FORWARD to see who has your name. Every guess arrives. HOLD is the control. Named aliases for real relationships only.
Anti-pattern: personal Gmail on the company site. Blast radius is your life. hello@ on the zone. Gmail stays the store.
Anti-pattern: plus-addressing as the long-term system. You cannot revoke it at the shop. Domain aliases you can disable.
Anti-pattern: kids catch-all. Safety problem. Parent-chosen names. HOLD the rest.
Anti-pattern: stealth promise. MX is public. Do not fake Google MX. Leftover MX is a split, not privacy.
Anti-pattern: twenty public brand nouns in a week. Short public list. Isolate shops. Do not clone the company.
Anti-pattern: new domain every leak. Expensive theater. Cut the string. Keep the zone. Auto-renew. Registrar lock.
Anti-pattern: anonymous email in an agency proposal for a brand zone. Strike it. Containment, not anonymity.
Anti-pattern: HIPAA vault story. Fourteen or ninety days. Not an archive. /security. Counsel for real holds.
Anti-pattern: sending as a leaked shop identity after disable. Rotate if that SMTP user leaked. Free has no send-as.
Anti-pattern: leftover builder MX so disable on MailerZ is incomplete. Two resolvers. Delete leftovers. Privacy needs exclusivity.
Practice: one alias per relationship you will isolate. Disable leaks. Replacement only if you still need the vendor.
Practice: yearly review. Disable unused shops. Probe that they stop. Password manager list is the source of truth.
Practice: third-mailbox probe after disable and after replacement. Self-send lies.
Practice: recovery mailbox for the registrar that is not public hello@. 2FA. Still own the name in 2030.
Practice: one paragraph in the brand or family guide. Named, HOLD, disable, keep the human inbox, exclusive MX, yearly review. Future you should not improve it into catch-all at midnight.
Operator closeout for long-term containment privacy
Containment keeps the domain and the human inbox. You cut leaked strings. That is not anonymity. Sites can see your zone. MX is public. WHOIS is registrar. MailerZ will not hide a website. If you needed to disappear, use a mask app and accept blocklists. Do not fake Google MX. That is a split, not privacy.
One named alias per relationship you will isolate. Disable shop-x@ when it leaks. Replace only if you still need the vendor. hello@ stays. Gmail stays. Plus-addressing cannot be revoked at the shop. Domain aliases can. That is why plus is not the long-term system.
HOLD unknown is the privacy control people skip. Catch-all FORWARD makes every guess a leak surface and trains junk. Dictionary admin@ and office@ should not arrive. Review held mail on a schedule. Create a named alias only when a relationship is real. Kids plus catch-all is a safety failure, not a cute trick.
Do not print personal Gmail on the company site. The blast radius is your life. A stable hello@ is the public contract. Individual first@ aliases can exist for family. They are still not catch-all. Short public lists. Twenty new brand nouns in a week is a disable nightmare, not privacy.
Exclusive MX so disable is complete. Leftover builder MX means some senders never see your cut. Two resolvers. Registrar lock. Auto-renew. Recovery mailbox that is not public hello@. A lapsed zone is a hijack. Still own the name in 2030. A new domain every leak is expensive theater.
Send-as as hello@ is paid identity. Do not keep sending as a leaked shop string. Rotate SMTP if that user leaked. Copy dashboard values. Free cannot send-as. Lists stay on an ESP. Caps exist. Do not burn reply SMTP as a privacy experiment.
Yearly review disables dead shops. Password manager list is the source of truth. Probe after disable from a third mailbox. Self-send lies. Message-IDs next to the vendor update. Offboard people who can create public aliases. Random new names are a leak of a different kind.
Enterprise wording stays honest. No HIPAA vault. Fourteen or ninety days is the store, not an archive. No SOC 2. /security. Counsel for real legal holds. Inboxing is not privacy. A folder is not a contain.
Agencies do not write anonymous email on a brand-zone proposal. Two aisles: durable strings on MailerZ, throwaways on a mask app. Exclusive MX only on the brand. Two-year test in a sheet. Re-run yearly when a shop becomes a keeper—then create a named brand alias instead of FORWARDing the zone.
Write one paragraph in the brand or family guide: named per relationship, HOLD, disable leaks, keep the human inbox, exclusive MX, yearly review. Future you at midnight should not improve it into catch-all. Start free, isolate two shops, disable one on purpose, and trust the motion before billing@ ever leaks.
Handoff memo for the next operator
Privacy strategies collapse when the only person who understood the alias map leaves. Write a memo that explains the namespace: which prefixes are public, which are vendor-specific, and which are never published. Include the rule for creating a new alias and the rule for killing one. The next operator should not invent a third naming scheme because the first two were undocumented.
List the vendors that already have unique aliases and the vendors that still have the shared public address. Shared addresses are the leak you will hunt later. The memo should make that hunt a calendar item, not a surprise.
Note the legal and billing identities that must remain stable for years. Those are not privacy experiments. Treat them as fixtures. If someone proposes rotating legal@ every quarter, the memo should make that proposal look as silly as it is.
Close with the store and catch-all policy in MailerZ: how long mail is kept, what happens to unknown recipients, and who reviews HOLD. Privacy without operations is a slogan. The next operator needs the operations.
Acceptance criteria before you call it done
A long-term privacy design is done when every vendor that can leak has its own alias, when legal and billing identities are stable and documented, and when a new hire can create the next alias without inventing a new prefix scheme. A pile of random addresses is not a strategy.
Prove the catch-all path once a quarter. Send to a typo and confirm HOLD or reject matches the memo. Prove store retention matches the plan you pay for. Privacy that depends on an expired trial is a countdown, not a control.
Put the alias map where the next operator will find it on a Sunday. If the map lives only in one inbox, you failed the acceptance test even if the aliases work.
FAQ
- What is the safest way to handle email privacy non disposable alias?
- Create a named alias per site or vendor you care to isolate. HOLD unknown. Disable leaks. Keep the human inbox stable. Exclusive MX. Do not mint infinite public brand names. Do not use catch-all as privacy.
- Does this require a new mailbox?
- No. MailerZ is not IMAP. Keep Gmail or Outlook unless you need a suite for other reasons.
- Will it work with Gmail or Outlook?
- Yes as destinations. Self-send is not proof. Use a third mailbox and open original.
- What DNS records are involved?
- Exclusive MX, verification TXT, one SPF if you send-as. Leftover MX is a hard stop. Dashboard values only for sending.
- What should I test before production?
- A uniquely titled probe from an unrelated provider to each public alias. Confirm Header From and hop history.
Key takeaways
- Containment, not anonymity.
- One alias per relationship.
- HOLD unknown.
- Disable leaks.
- Keep the human inbox.
- Exclusive MX.
- Not disposable brand identity.
- Yearly review.
Conclusion
Long-term privacy on email is a map you can cut. Own the zone. Name the relationships. Hold the rest.
Start free, isolate two shops, and disable one on purpose so you trust the motion.