Disposable email addressing, also known as DEA, dark mail or masked email, refers to an approach that involves a unique email address being used for every contact, entity, or for a limited number of times or uses. The benefit is that if anyone compromises the address or utilizes it in connection with email abuse, the address owner can easily cancel (or "dispose" of) it without affecting any of their other contacts.

Uses

Disposable email addressing sets up a different, unique email address for every sender or recipient combination. It operates most usefully in scenarios where someone may sell or release an email address to spam lists or to other unscrupulous entities. The most common situations of this type involve online registration for sites offering discussion groups, bulletin boards, chat rooms, online shopping, and file hosting services. At a time when email spam has become an everyday nuisance, and when identity theft threatens, DEAs can serve as a convenient tool for protecting Internet users.^[1]

Disposable email addresses can be canceled if someone starts to use the address in a manner that was not intended by the creator. Examples are the accidental release of an email to a spam list, or if the address was procured by spammers. Alternatively, the user may simply decide not to receive further correspondence from the sender. Whatever the cause, DEA allows the address owner to take unilateral action by simply canceling the address in question. Later, the owner can determine whether to update the recipient or not.

Disposable email addresses typically forward to one or more real email mailboxes in which the owner receives and reads messages. The contact with whom a DEA is shared never learns the real email address of the user. If a database manages the DEA, it can also quickly identify the expected sender of each message by retrieving the associated contact name of each unique DEA. Used properly, DEA can also help identify which recipients handle email addresses carelessly or illegitimately. Moreover, it can serve as a tool for spotting fake messages or phishers.

Advantages over traditional email

Ideally, owners share a DEA once with each contact/entity. Thus, if the DEA should ever change, only one entity needs to be updated. By comparison, the traditional practice of giving the same email address to multiple recipients means that if that address subsequently changes, many legitimate recipients need to receive notification of the change and to update their records — a potentially tedious process.

Additionally, because the access has been narrowed down to one contact, that entity then becomes the most likely point of compromise for any spam that the account receives (see "filtering" below for exceptions). This allows users to determine first-hand the trustworthiness of the people with whom they share their DEAs. "Safe" DEAs that have not been abused can be forwarded to a real email account, while messages sent to "compromised" DEAs can be routed to a special folder, sent to the trash, held for spam filtering, or returned as undeliverable if the DEA is deleted outright.

Further, because DEAs serve as a layer of indirection between the sender and recipient, if the DEA user's actual email address changes, for instance because of moving from a university address to a local ISP, then the user need only update the DEA service provider about the change, and all outstanding DEAs will continue to function without updating.

Using "sub-addressing"

A number of email systems support "sub-addressing" (also known as "plus" or "tagged" addressing)^[2][3][4] where a tag can be appended to the "local part" of an email address — the part to the left of the "@" — but with the modified address being an alias to the unmodified address. For example, the address joeuser+tag@example.com denotes the same delivery address as joeuser@example.com. The text of the tag may be used to apply filtering, or to create single-use addresses.

If available, this feature can allow users to create their own disposable addresses;^[5] however it reveals the user's delivery address to email recipients.

Multiple email aliases

Another approach is to register one main email address and many auxiliary email addresses, which will forward all mail to the main address, i.e., the auxiliaries are used as aliases of the main address. The advantage of this approach is that the user can easily detect which auxiliary email is 'leaking' with spam and block or dispose it.

Some services require additional time to set up forwarding, but others allow to create new addresses "on the fly" without registering them with the service in advance. However, this method allows storage and access of all emails from a single main account, although to manage forwarding for some services the user has to remember the password for each alias.

A variation is to use a catch-all address, then forward to the real mailbox using wildcards. Many mail servers allow the use of an asterisk (*), meaning "any number of characters". This makes the whitelist automatic and only requires the administrator to update the blacklist occasionally. In effect, the user has one address, but it contains wild cards, e.g., "me.*@my.domain'", which will match any incoming address that starts with "me." and ends with "@my.domain". This is very similar to the "+" notation, but it may be even less obvious, since the address appears to be completely normal.

Concerns

See also

• Guerrilla Mail

References