Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

One of the many benefits of owning my own email server:

- I have a catch all setup to forward all emails to specific user on mail server

- able to setup adhoc email addresses for each online service (ie, [email protected])

- able to claim example.com in haveibeenpwned

Now I get breach emails from hibp for the whole domain. Unfortunately, I was exposed in this IA breach



In case anyone would like these benefits but doesn't want to actually run an email server: All you actually need to accomplish this is a domain name and a decent provider. Fastmail is what I use and it's been great for me.


To be even easier, you can just have Apple or Google hold your domain and provide mail.


That's not easier, that's the same but with a worse scale fit.

If you need free, you need free.

But if you can pay, you want to pay a vendor whose scale is such that you mean something to them while still being mature enough to rely on.

This applies to pretty much everything, not just email.

With Google and Apple, you service needs are overhead and with Google in particular, your value is entirely in them being able to monitor as much as they legally can about your activity.

With Fastmail, Protonmail, etc, you are a customer already and they're invested in making you a bigger happy cuatomer in the future. They have staff that will service your support tickets, you represent profit on their books, and the services they offer you are generally designed for your scale more precisely.


They mean getting a Gmail account


It’s risky to let your online identity be controlled by a single large provider. Distribute out the services you use as much as possible. Use a different email provider from your domain registrar, and different from the providers of any other online account you have.


I'm not 100% sure that that gets you wildcard email addresses that all point to the same inbox, but if they support that, sure!


Google has it, though I think you need the paid Workspace version? I’m paying around $15/month now ever since google killed the free tier for custom domains.


Not sure about Apple, but Google calls has that and calls it catch-all-routing.


I don’t know about Google, but I know iCloud supports domain wildcarding


Proxy address ie [email protected] you would use [email protected] and have rules to match that


It’s [email protected], and it’s a poor substitute for a dedicated domain. For one, every attacker knows about plus addressing and that those addresses are really all the same email account.


They still don't know what you put after the "+" to log into another service.


You can do this easily (and for free) via Cloudflare [1]. Works great, I've been using it across several domains for quite some time. Migrated from Google.

[1] https://www.cloudflare.com/en-ca/developer-platform/email-ro...


yea, but now i rely on cloudflare which is no-go for me.


Would you elaborate why it’s a no-go for you? Just curious for my own sake


Cloudflare CEO Matthew Prince is bffs with ex CIA Mike Janke https://www.reddit.com/r/TrueAnon/comments/p0wifx/here_is_mi...


I don't know their reasons, but for me, I do use cloudflare, but only in a way that I have a transfer-off plan.

So far as I can tell, Cloudflare seems to still be in the early stages of enshittification [1], and while I as a business customer am probably going to be taken for a ride later than most customers, I'm also small fry, so I'm guessing at some point in the next 5 years, some of the "for free" features like zero trust / tunnels are going to become prohibitively expensive for me.

[1] https://pluralistic.net/2023/01/21/potemkin-ai/#hey-guys

I assume Cloudflare will enshittify because too much of its services are free or too cheap to make sense, so my guess is they're trying to achieve massive market capture and dependency so they can later start squeezing customers for way more money.

I prefer more transparent cost structures, like what I get through Migadu for example.


Too much centralization is a single point of failure?


decentralization.

I don’t want these massive entities (Google, MS, CF) controlling my data.


Cloudflare isn't even that big. They're 1/100th the size of Google or MS. They're not even the biggest CDN—Akamai has twice the revenue, but it depends on what you measure. Cloudflare gets brought up disproportionately often on HN because they have generous free tiers and cater to indie hackers more. So it feels a little ironic that they're perceived as "the big dog" by the indie hackers.


It feels like every website uses them as a web proxy, meaning they get to 1) decide which users can access the site using their own opaque methodology and 2) MITM/inspect a large percentage of web traffic.


I think spreading out between them is a good strategy. Cloudflare has been flawless for me for email.


I used to do this, now I use icloud and the 'hide my email' tool and it works without any hassle. Even asks me when signing up for something if I want to hide my email. It is easier than adding it to my old setup. Even easier than when I was using my free Google for Business setup.

The rest of apple's email landscape sucks. It is pretty poor at managing spam, the client is terrible, it doesn't sync rules between the desktop app, icloud email, and iphone.

I hate email in general. It is getting to be 1 in a 100 type scenario of anything of value and likely worse if I knew all the emails that were deleted before I saw them.


I recently ran into an issue where Toyota’s app/site was detecting and refusing Apple iCloud hide-my-email addresses when trying to sign up.

The error message was very clear: hide-my-email was not permitted.

I was just trying to check for available service appointments near me and didn’t want the spam. But I guess sending spam is very very important to Toyota.



Google workspace lets you do it if they mange emails for your domain (and it will cost ~5-10$/month if you are the only user)

https://support.google.com/a/answer/12943537?hl=en


it “works”, but handing over this control to Google is a no-go for me.


The only drawback being that all of your outgoing email is sent directly to the receiver’s spam folder..?


Memes are fun and all but this one is both untrue and just serves to entrench the big bastards, who don't need any more help.


I often use custom domains for email and haven't encountered this. From what I know, the best practice is to use a domain that you have had for a while and to use nameservers or MX records from an established service (basically). I don't run my own server but I am sure there are tricks to getting it to work that way too.


Use a commercial service then, they're cheap and provide every benefit mentioned by GP. The thing that you really need is not your own server, but your own domain.


I've never had this issue, been running my own email server for almost 10 years.


I do the same thing. Absolutely worth the small hassle.


You don't need to deal with the hassle of your own email server for this. Just buy a domain and use Fastmail, Protonmail, or any other service you trust.


Simplelogin can do the first two. The third matters little anyways if you don't reuse passwords.


Great until you need to give someone an email address in real life and awkwardness ensues.

  Cashier: "What's your email?"
  Me:      "[email protected]"
  Cashier: "No I meant YOUR email address."
  Me:      "Yeah [email protected]"
  Cashier: "Oh do you work for Walmart???"
  Me:      "No see I set up my email so... oh nevermind, [email protected]"


I do this. I just say "this will sound strange but my email is ..." and then spell it.

I think if you are at the level of catch-alls and your own domain(s) then you tell the cashier "no thanks!"


i have a similar setup for the past 20 years or so. I rarely get a raised eyebrow at giving [email protected], and if i do i state it upfront “this is for categorization” and never had to explain it again.


Zero problem. I have used this exact setup with my domain for over 23 years. First, it's rare that I had to give my email over the phone or something. And in the couple of times someone raised an eyebrow, it was an opportunity to educate the person that yes, "donotspamYOURCOMPANY@" is indeed a valid address (not exactly what I use, but similar).

The advantages are numerous: tracking who leaked my data (many times before the company even noticed it), easier to spot spam (20 years ago spam filters were a lot less sophisticated), minimize credential stuffing (before Pwd Managers became the norm), etc.


I recently started getting "targeted" bitcoin extortion emails that have your home address (or what they scraped from public records) and a picture of Google Street view, but they're all going to the email I used for a now-defunct online grocery


Ha, same here. Including photos of my house (well, actually my neighbor's house) and everything.

I'd be worried if 1) I hadn't seen many versions of similarly creative extortion emails over the years, and 2) if they hadn't use some obvious "donotspamCompanyThatWasHacked@mydomain".

Sadly, I can see how this may trick some people into sending money to scammers.


I have this same setup and this conversation happens often, you get used to it happening and navigating it.

ON only one occasion in ~20 years, someone refused to do business with me because they thought I was impersonating them and told me I was being disrespectful by using their brand as my email, and even after explaining how it works they weren't happy.



Meh, it’s not that bad. I have a short domain and usually use an abbreviated version for user part. If it’s a big corp, just the stock ticker will suffice and nobody bats an eye. Some boomers raise an eye if it’s not @gmail.com or one of the big providers, but otherwise nobody cares.

But better than giving them an iCloud “hide my email” generated addy ;)


Just like how some people think GitHub is git.


All things that aren’t remotely unique to running your own mail server.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: