Anonymous Email Forwarding

This is the source code for self-hosting addy.io.

FAQ

• [Why is it called addy.io?](#why-is-it-called-addyio)
• [Why did you make this site?](#why-did-you-make-this-site)
• [Why should I use addy.io?](#why-should-i-use-addyio)
• [Do you store emails?](#do-you-store-emails)
• [What is a shared domain alias?](#what-is-a-shared-domain-alias)
• [What is a standard alias?](#what-is-a-standard-alias)
• [Can I use my own domain?](#can-i-use-my-own-domain)
• [Can I add a domain and also use it as a recipient?](#can-i-add-a-domain-and-also-use-it-as-a-recipient)
• [Can I add a domain if I'm already using it for email somewhere else?](#can-i-add-a-domain-if-im-already-using-it-for-email-somewhere-else)
• [Why should I use this instead of a similar service?](#why-should-i-use-this-instead-of-a-similar-service)
• [Is there a browser extension?](#is-there-a-browser-extension)
• [Is there an Android app?](#is-there-an-android-app)
• [Is there an iOS app?](#is-there-an-ios-app)
• [Is there a Raycast extension?](#is-there-a-raycast-extension)
• [How do I add my own GPG/OpenPGP key for encryption?](#how-do-i-add-my-own-gpgopenpgp-key-for-encryption)
• [Are attachments encrypted too?](#are-attachments-encrypted-too)
• [Are forwarded emails signed when encryption is enabled?](#are-forwarded-emails-signed-when-encryption-is-enabled)
• [Can I reply/send from aliases using encryption?](#can-i-replysend-from-aliases-using-encryption)
• [Is my public GPG/OpenPGP key removed when I reply/send from an alias?](#is-my-public-gpgopenpgp-key-removed-when-i-replysend-from-an-alias)
• [Can I mark emails forwarded to me by addy.io as spam?](#can-i-mark-emails-forwarded-to-me-by-addyio-as-spam)
• [Can I use aliases to create multiple accounts on other websites and services?](#can-i-use-aliases-to-create-multiple-accounts-on-other-websites-and-services)
• [Can I have multiple Free accounts?](#can-i-have-multiple-free-accounts)
• [What if I don't want anyone to link ownership of my aliases together?](#what-if-i-dont-want-anyone-to-link-ownership-of-my-aliases-together)
• [Where is the server located?](#where-is-the-server-located)
• [What if I don't trust you?](#what-if-i-dont-trust-you)
• [What is the maximum number of recipients I can add to an alias?](#what-is-the-maximum-number-of-recipients-i-can-add-to-an-alias)
• [What happens when I delete my account?](#what-happens-when-i-delete-my-account)
• [Does this work with any email provider?](#does-this-work-with-any-email-provider)
• [How do I reply to a forwarded email?](#how-do-i-reply-to-a-forwarded-email)
• [I'm trying to reply/send from an alias but the email keeps coming back to me, what's wrong?](#im-trying-to-replysend-from-an-alias-but-the-email-keeps-coming-back-to-me-whats-wrong)
• [I'm trying to reply/send from an alias but it is rejected, what's wrong?](#im-trying-to-replysend-from-an-alias-but-it-is-rejected-whats-wrong)
• [I've been forwarded an email with a red warning banner saying it may have been spoofed, what does it mean?](#ive-been-forwarded-an-email-with-a-red-warning-banner-saying-it-may-have-been-spoofed-what-does-it-mean)
• [Does addy.io strip out the banner information when I reply to an email?](#does-addyio-strip-out-the-banner-information-when-i-reply-to-an-email)
• [How do I send email from an alias?](#how-do-i-send-email-from-an-alias)
• [Will people see my real email if I reply to a forwarded one?](#will-people-see-my-real-email-if-i-reply-to-a-forwarded-one)
• [Can emails have attachments?](#can-emails-have-attachments)
• [What is the max email size limit?](#what-is-the-max-email-size-limit)
• [What happens if I have a subscription but then cancel it?](#what-happens-if-i-have-a-subscription-but-then-cancel-it)
• [If I subscribe will Stripe see my real email address?](#if-i-subscribe-will-stripe-see-my-real-email-address)
• [Do you offer student discount?](#do-you-offer-student-discount)
• [How do you prevent spammers?](#how-do-you-prevent-spammers)
• [What do you use to do DNS lookups on domain names?](#what-do-you-use-to-do-dns-lookups-on-domain-names)
• [Is there a limit to how many emails I can forward?](#is-there-a-limit-to-how-many-emails-i-can-forward)
• [Is there a limit to how many aliases I can create per hour?](#is-there-a-limit-to-how-many-aliases-i-can-create-per-hour)
• [How is my bandwidth calculated?](#how-is-my-bandwidth-calculated)
• [How many emails can I receive before I go over my bandwidth limit?](#how-many-emails-can-i-receive-before-i-go-over-my-bandwidth-limit)
• [What happens if I go over my bandwidth limit in a given month?](#what-happens-if-i-go-over-my-bandwidth-limit-in-a-given-month)
• [Can I login using an additional username?](#can-i-login-using-an-additional-username)
• [I'm not receiving any emails, what's wrong?](#im-not-receiving-any-emails-whats-wrong)
• [I'm having trouble logging in, what's wrong?](#im-having-trouble-logging-in-whats-wrong)
• [How do I know this site won't disappear next month?](#how-do-i-know-this-site-wont-disappear-next-month)
• [What happens to addy.io if you die?](#what-happens-to-addyio-if-you-die)
• [Is the application tested?](#is-the-appliction-tested)
• [How do I host this myself?](#how-do-i-host-this-myself)
• [Who's behind addy.io?](#whos-behind-addyio)
• [I couldn't find an answer to my question, how can I contact you?](#i-couldnt-find-an-answer-to-my-question-how-can-i-contact-you)

Why is it called addy.io?

Addy is short for "Address". The word "Addy" is internet slang for an email address, e.g.

> "My addy is being spammed. I should've kept it private."

Why did you make this site?

I made this service after trying a few other options that do a similar thing. I was really interested in how they worked and loved the thought of protecting my real email addresses from spam.

I also wanted to address some issues with other services such as:

• Proprietary closed source code
• Adverts, analytics and trackers used on the sites
• No option to encrypt emails using a GPG/OpenPGP key
• No option for multiple recipients

I made the code open-source to show everyone what was going on behind the scenes and to allow others to help improve the application.

I use this service myself for the vast majority of sites I'm signed up to.

Why should I use addy.io?

There are a number of reasons you should consider using this service:

• Protect your real email address from spam by simply deactivating/deleting aliases that receive unsolicited emails
• Identify who has sold your data by using a different email address for every site
• Protect your identity in the event of a data breach by making it difficult for hackers to cross-reference your accounts
• Prevent inbox snooping by encrypting all inbound emails using GPG/OpenPGP encryption
• Update where emails are forwarded without having to go through and change your email address for each site individually
• Reply to forwarded emails anonymously without revealing your true email address

Do you store emails?

Emails are only ever stored in the event of a failed delivery, and only if you have this option enabled in your account settings.

What is a shared domain alias?

A shared domain alias is any alias that has a domain name that is also shared with other users. For example anyone can generate an alias with the @anonaddy.me domain. Aliases with shared domain names must be pre-generated and cannot be created on-the-fly like standard aliases.

What is a standard alias?

A standard alias is any alias that can be created on-the-fly. Automatic on-the-fly alias creation is only available for domains that are unique to you. For example, your unique username subdomain, any additional usernames or any custom domains. So if you signed up with the username "johndoe", any alias you create using @johndoe.anonaddy.com would be a standard alias (even if you've generated a Random Character/Random Word one).

Can I use my own domain?

Yes you can use your own domain name so you can also have *@example.com as your aliases. To do so you simply need to add a TXT record to verify your ownership of the domain. Then you will need to add an MX record to your domain so that our server can handle incoming emails. You can then add a few other records to enable sending from your domain too.

Can I add a domain and also use it as a recipient?

No, you cannot use the same domain as a custom domain and also for a recipient on addy.io.

e.g if you add "example.com" as a custom domain, you cannot then add "[email protected]" as a recipient. This is because a domain cannot direct email to multiple locations simultaneously using MX records. So your email would arrive for "example.com" and then attempt to be forwarded to "[email protected]" which would create a loop.

You can instead use a subdomain for your custom domain, e.g. "mail.example.com" instead of "example.com", this would allow you to create *@mail.example.com for your aliases. More details can be found here.

Can I add a domain if I'm already using it for email somewhere else?

If you have a custom domain say example.com and you are already using it for email somewhere else e.g. ProtonMail or Namecheap then you cannot also use it simultaneously with addy.io.

This is because emails cannot be handled by multiple different mail servers at the same time, even if they have the same priority MX records. It can only be delivered to one mail server at a time which will typically be the MX record with the smallest number since this has the highest priority.

You can either:

• Migrate your domain to addy.io by removing the current provider's MX records and adding addy.io's.
• Or, if you would like to keep using your domain with your current email provider then I would recommend instead adding a subdomain of it to addy.io such as mail.example.com.

Using a subdomain will not interfere with your current email setup and you'll be able to create aliases *@mail.example.com through addy.io.

Why should I use this instead of a similar service?

Here are a few reasons I can think of:

• Bring your own GPG/OpenPGP key to encrypt your forwarded emails (and the option to replace subjects)
• No adverts
• No analytics or trackers (just server access logs)
• No third party content
• Open-source application code
• No limitation on the number of aliases that can be created
• Generous monthly bandwidth
• Multiple domains to choose for aliases (currently anonaddy.com, anonaddy.me and more for paid plan users)
• Ability to generate random character and random word aliases at shared domains
• Ability to add additional usernames to compartmentalise aliases
• New features added regularly

Is there a browser extension?

Yes there is an open-source browser extension available to download for Firefox and Chrome (also available on other chromium based browsers such as Brave and Vivaldi). You can use the extension to generate new aliases remotely.

Is there an Android app?

Yes, there's the official open-source Android app created by Stjin that is available to download from the Play Store and F-Droid.

Is there an iOS app?

Yes, there's the official open-source iOS app created by Stjin that is available to download from the App Store.

Is there a Raycast extension?

Yes, http.james' open-source extension is available on the Raycast Store.

How do I add my own GPG/OpenPGP key for encryption?

On the recipients page you simply need to click "Add public key" and paste in your public key data. Now all emails forwarded to you will be encrypted with your key. You can even hide and encrypt the subject as addy.io supports protected headers.

Are attachments encrypted too?

Yes attachments are part of the email body and are also encrypted if you have it enabled.

Are forwarded emails signed when encryption is enabled?

Yes when you have encryption enabled all forwarded emails are signed using our [email protected] private key.

You can add this key to your own keyring so that you can verify emails have come from us.

The fingerprint of the [email protected] key is "26A987650243B28802524E2F809FD0D502E2F695" you can find the key on https://keys.openpgp.org.

Can I reply/send from aliases using encryption?

1. If the person you are sending your message to already uses GPG/OpenPGP encryption then you can simply encrypt your reply/send from your alias using their public key.

2. If the person you are sending your message to does not use GPG/OpenPGP encryption then you can instead encrypt your reply/send with the [email protected] public key ("26A987650243B28802524E2F809FD0D502E2F695"). Your reply/send will then be automatically decrypted on the addy.io server before being sent on to the correct destination in clear text. This is useful if you wish to hide your replies/sends from your email provider such as Gmail.

Is my public GPG/OpenPGP key removed when I reply/send from an alias?

Yes, any attached GPG/OpenPGP public keys or GPG/OpenPGP signatures are automatically removed when replying or sending from an alias. This is to prevent you accidentally revealing your real email address which is usually shown as an identity in your public key.

Can I mark emails forwarded to me by addy.io as spam?

No, you must not mark messages forwarded to you by addy.io as spam as this can damage the reputation of the mail servers and is against the terms and conditions.

If an alias is receiving spam messages then please deactivate it or delete it.

addy.io is signed up to multiple feedback loops (FBLs) that trigger a notification when any messages are marked as spam. Repeatedly marking messages as spam will result in your account being disabled.

Can I use aliases to create multiple accounts on other websites and services?

No, you must not use addy.io to create large numbers of accounts on other websites/services as this is against the terms and conditions.

Can I have multiple Free accounts?

Having multiple Free accounts is not considered an acceptable use of our service. Any users found to be abusing this rule may have their accounts disabled. This does not apply to those with a paid subscription.

What if I don't want anyone to link ownership of my aliases together?

If you're concerned that your aliases are all linked by your username e.g. @johndoe.anonaddy.com, then you have a couple of options:

1. You can generate random character or random word aliases instead, these are all under a shared domain and cannot be linked to a user.
2. You can add additional usernames and separate your aliases under each of them. e.g. you could have one username for personal stuff, another for work, another for hobbies etc.

Where is the server located?

The server is located in Amsterdam, Netherlands with Greenhost.net. Greenhost focuses greatly on privacy and security and their servers run entirely on Dutch wind energy. The backup mail server is located in Warsa

…

Collapse