Catch-all domains: only auto-create aliases with a specific prefix

[fazy]

Once enough spammers get hold of a domain, it will start to receive email addressed to many guessed names such as jon@example.com, jane@example.com or even fkdlfakjd@example.com. This makes it unusable with SimpleLogin - if we have to keep suppressing them, it's no better than a Gmail filter.

Please make it possible to only accept email on the catch-all domain when the receiver (envelope) email address has a specific, configurable prefix.

Examples:

• A user Alice was previously using the + trick on her domain, so she could add a rule to allow only only emails starting with alice+.
• Bob is using emails in the format bob.<anything>.12345@example.com (where 12345 is a random number), so he could add a rule to only allow emails starting with bob..
• Charlie could be using charlie-something@example.com and set a prefix of charlie-.

The point is, a prefix rule could be fairly simple and cover many use cases. Although a full pattern matching or regex would be fine too.

Is it foolproof?

Of course not, but after 20 years and about 2000 email addresses, I have never seen spammers guessing a prefix like this. Especially if you use a constant but obscure prefix. It would cut down 99.9% of my spam.

Could directories be used?

Maybe, if it gets implemented (#415), but directories only use /, # and + as the separator which gives rise to two problems:

1. These characters will break with many online services (worst of all is when sign-up works, but something breaks later such as password reset).
2. If someone is using another character already such as . or -, then they cannot migrate an existing domain.

Directories could solve this use case if:

1. For custom domains, we can choose the separator character
   AND
2. We can reject mail that doesn't match any directory.

[WhamboMPS]

@fazy, I have not personally experienced this problem (and am not sure how common it is). Here are three potential workarounds that could address the issue described:

1. If you start receiving directory based spam against example.com, close example.com and open (and delegate) a new domain such as example2.com to SimpleLogin.
2. Use the domains that come with SimpleLogin such as aleeas.com. When an address is created on these domains a hyphen and five character suffix is automatically added to the email address' prefix (yes, a suffix to the prefix). So, for instance, instead of jon@aleeas.com SimpleLogin will create jon-xps5g@aleeas.com. No directory attack will send spam to addresses crafted like this.
3. Using your own custom domain use your own suffix rule and then use a client-side rule to filter out mail that does not meet that rule's criterion. For instance, for custom domain example.com only create aliases with the suffix -nmsfm (e.g. No More Spam For Me). This means that you wouldn't create jon@example.com as a SimpleLogin alias but rather would create jon-nmsfm@example.com. Using this technique you could then filter out incoming email that does not contain a suffix with this format mask.

[fazy]

Thanks for the suggestions @WhamboMPS, it's good to have all the options. However I am not sure if they work for me:

1. In order to close example.com and open example2.com I would need to notify every service I'm using about the new domain (and getting them to comply is a world of pain). I would also need to keep example.com registered for a long time (I prefer 10+ years) to prevent anyone else registering that domain and gaining access to any accounts not successfully migrated.
2. Similar to item 1, except that I would also be tied into this service.
3. This negates the reason why I'd bother with SimpleLogin. I can already create rules in Gmail (linked to Google Workspaces with a catch-all domain) to filter out (a) anything without the desired prefix and (b) any compromised addresses. These emails would go to the trash. But I would rather use SimpleLogin to make sure emails to compromised or guessed addresses are rejected. I don't know for sure if any spammers anywhere will stop sending email after a bounce, but there are also many supposedly legitimate companies that don't comply with GDPR (either because it doesn't apply to their jurisdiction, or because it's not well enforced) using the likes of MailChimp et al, who might just get the hint if email bounces rather than getting silently filtered to the trash. For privacy reasons, even the Gmail trash is less preferable to the list on my SimpleLogin dashboard. If I choose to migrate from Gmail to ProntonMail or Tutanota, their filtering capability isn't up to the job just yet. This option would also create a huge list of aliases in my SimpleLogin control panel.

I realise the suggestions will help other people and use cases. However I think a very basic filter function would add considerable flexibility. I'd be willing to pay extra for it, just as I'm willing to pay for the service now while I'm evaluating it.

[nguyenkims]

This has been now been supported as you can now define the regular expression for auto-create aliases for a custom domain :). This feature was released yesterday so it's still beta :).