Every time users sign up for a new service, they're asked for an email address. That address becomes a permanent identifier, shared across data brokers, sold to advertisers, and eventually leaked in breaches.
Masked emails change that equation.
What Are Masked Emails?
A masked email is a unique, randomly generated address that forwards to your real email. Instead of giving out jane@gmail.com, you give out xk7m9p@shield.postscale.io.
If that address gets compromised or spammed, you simply disable it. Your real address stays private.
Benefits for Users
- Privacy: Your real email stays hidden
- Control: Disable any alias instantly
- Organization: Know exactly which service is emailing you
- Security: If one alias leaks, others are unaffected
Benefits for Platforms
Offering masked emails to your users isn't just good for them - it's good for you:
- Trust: Users are more likely to sign up when privacy is protected
- Deliverability: Emails go to users who actually want them
- Differentiation: Stand out from competitors who don't offer this
Implementation with Postscale Shield
Create a Shield alias using the documented REST API from your server. Keep the API key out of browser code. This example uses a placeholder destination you must replace with an authorized, verified address:
curl https://api.postscale.io/v1/shield/aliases \
-H "Authorization: Bearer $POSTSCALE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"forward_to":["person@example.net"],"description":"my-platform"}'
Read the returned alias address and domain from the response; do not assume a fixed domain. See the Shield API reference for entitlements, verification requirements and errors.
Shield replies and personal-domain forwarding differ
Shield injects a tokenized Reply-To address into forwarded mail so supported replies return through the alias. Check that Reply-To is present and avoid including identifying details in your signature or quoted content. Send a test reply and check the address the correspondent sees.
Ordinary personal-domain forwarding delivers into an existing inbox. Sending a new message or replying as that domain needs an outgoing identity in a compatible client and an authorized SMTP service. SRS handles delivery-failure addresses; it does not choose the client's From address. See how SRS works and SMTP configuration.
The Privacy-First Future
For address choices on your own domain, compare email aliases, catch-all and mailboxes. For service selection, see forwarding versus mailbox hosting.
As users become more privacy-conscious, platforms that respect that preference will win. Masked emails are a simple, powerful way to show you take user privacy seriously.
Ready to add masked emails to your platform? Get started with Postscale Shield.