Spam on an email alias is unsolicited mail arriving on a forwarding address created for one service. Containment follows a fixed order: identification of the source, creation of a replacement alias, update of the account address, closure of the old alias by pause or deletion, and reporting of the sender. The order protects account access, because mail sent to a paused or deleted alias bounces, so password resets and account mail sent after closure never arrive. This article covers that sequence only; diagnosis and general prevention belong to separate guides, linked where each step uses them.
Source identification
Source identification compares the address on the spam with the service recorded for that alias. An alias recorded for one shop receives mail connected to that shop only. Mail from strangers on that alias shows that the address moved beyond the shop, through a breach, a sale, or a partner share. The alias does not show which route the address took, and the containment sequence does not depend on that detail. That detail changes the reporting step, not the closure.
A second comparison checks whether the mail matches the expected sender. Mail about one company arriving on another company's alias is mail from a sender using that company name, and the alias exposes the mismatch by channel rather than by content. The guide on how phishing uses a leaked email describes that channel test in full. Mail that matches the expected sender is a different case: a real service, or its partners, mailing an address it legitimately held. A breach lookup on Have I Been Pwned shows whether the address appears in a known breach, which separates a breach-driven wave from ordinary partner marketing. The attribution step is covered by the guide on which website leaked an email address.
Replacement alias
An alias address cannot be renamed. The Edit view on an alias card has no field for the address, so a different address means creating a new alias and updating the service account to it. The creation form takes a name, a domain, a destination inbox, and the company or website. Recording the company matters, because AliasFleet flags the alias if a different company ever emails it. The creation steps are in the guide on creating aliases, and the short version for a first alias is in the guide on making a first alias.
The replacement sequence runs in a fixed order. The new alias is created first. The service account is updated to the new alias second, and a confirmation or test message is checked in the destination inbox. The old alias is paused or deleted third. Reversing the second and third steps repeats the original error, because the account then points at a dead address. When the service rejects the new alias, the old alias stays paused rather than deleted, so the account stays reachable while the rejection is resolved. Some sites reject alias domains outright, as a property of the site, not of the alias.
The full address is copied from the alias card, not typed from memory, because one wrong character sends the account update to a different address or nowhere at all. The copying procedure is in the guide on copying an alias address. The free tier covers 10 active aliases, so a replacement counts against that limit until the old alias is deleted and frees its slot.
Account address update
The sign-in address and the recovery address on the service account are updated before the old alias closes, where the account still uses that alias. A paused or deleted alias bounces mail sent to it, so a password reset, receipt, or security notice sent after closure never arrives. Updating the address first keeps the account reachable through the new address while the old one closes. The same check applies to every other account that uses the same alias as a recovery address, with each account updated one at a time before closure. Shared use breaks the one-alias-per-service pattern, and spam on the alias can expose it. The guide on how to use email aliases sets out that pattern.
Closure before the account update cuts off password resets and account mail, because mail to a paused or deleted alias bounces. The replacement alias is created and the service account is updated to it before the old alias is paused or deleted.
Financial accounts sit outside this procedure. A bank account keeps a permanent real address used only for financial accounts, never a masked or relay alias, because recovery, statements, and fraud alerts depend on that address. That address is left unchanged, and spam on it is handled with provider tools.
Pause and deletion
Pause and deletion differ in reversibility, in what survives, and in what the sender sees, and the choice follows from whether the address will ever be needed again. Pausing stops forwarding at once. The toggle on the alias card switches forwarding off with no confirmation step, and the change takes effect immediately. Mail sent to a paused alias bounces back to the sender with a standard delivery failure, so the sender reads it as an address that does not exist. The alias, its settings, and its history stay in the account, and forwarding resumes when the toggle switches back on. Mail sent while paused does not wait and does not arrive later. The full mechanics are in the guide on activating and deactivating an alias.
Deletion ends the address. The three-dot menu on the alias card opens a confirmation dialog, and confirming removes the alias, its forwarding history, and its statistics at once. The alias count drops by one, which frees a slot on the plan. There is no undo, no recycle bin, and no recovery. A deleted address cannot be recreated, so mail sent to it afterwards bounces permanently. The full mechanics are in the guide on deleting an alias. Deletion before replacement also removes the forwarding history that recorded what the alias received, and it removes the address itself, so a service that still lists it as the contact address can no longer be reached through it.
| Choice | Effect on mail | Reversible | History kept |
|---|---|---|---|
| Pause | Bounces while paused | Yes, toggle back on | Yes |
| Delete | Bounces permanently | No | No |
Pausing fits cases where the address might be needed again, where the spam might be a short burst, or where the decision is not yet final. A paused alias can be deleted later, once the replacement is confirmed working. Deletion fits cases where the address will certainly never be needed again, or where a replacement alias already serves the same service and the old address is residue.
Sender reporting
Reporting is the last step, because it does not close the channel. Reporting trains filters and feeds enforcement records. Pausing or deleting the alias is what stops the mail, and reporting alone leaves the address open. The reporting route depends on the provider and on whether the mail is noise or fraud.
In Gmail, mail reported as spam moves to the Spam folder, and Google receives a copy of the message and may analyse it to protect users from spam and abuse. The reporting steps are in the Gmail help page on reporting spam in Gmail. Blocking is a separate control: after a sender is blocked, all future mail from that sender goes to Spam, as described in the Gmail help page on blocking an email address. Blocking does not unsubscribe the address from anything, and it does not close the alias. For mail that asks for sign-in details or money, the phishing report is the correct control, not the spam report.
In Outlook, the Report button offers two choices with different effects. A message reported as junk moves to the Junk Email folder and the sender joins the Blocked Senders list. A message reported as phishing is deleted. The effects are documented in the Microsoft Learn page on reporting phishing and suspicious emails in Outlook. As with Gmail, neither effect touches the alias itself.
For mail that is fraud rather than noise, the report goes further. The FTC fraud report starts with a Report Now button followed by questions that narrow down the report type, as described in the FTC page on reporting fraud. A report there does not resolve an individual case. Its value is pattern evidence: many reports against one sender, domain, or payment method give investigators the material for a case.
One control is absent from this procedure by design: the unsubscribe link in mail from an unknown sender. Clicking it tells the sender the address is live and read, and on scam mail it can lead to a page that harvests credentials. The guide on whether clicking unsubscribe in spam is safe sets out the two cases: unsubscribe belongs to mail from a list actually joined, and reporting belongs to everything else. On an alias about to close, the question ends with the alias, since forwarding stops for every list the address was on.
AliasFleet containment controls
AliasFleet provides email aliases as managed, persistent forwarding addresses: one alias per service, forwarding to a real destination inbox, with a pause toggle and a delete control on each alias card. An alias lasts for years, receives password resets and receipts like any address, and stops forwarding the moment it is paused or deleted. The pause toggle is the containment control, and deletion is its permanent version.
The same section states the limits of those controls. AliasFleet does not remove the address from breach dumps, broker lists, or mailing lists that already hold it, and it cannot show how the address moved from the service to the sender. Those limits are properties of the system. The controls close the forwarding channel; they do not erase the address from sources that already hold it.
Containment sequence
The sequence, in order, is source identification, replacement alias creation, account address update, closure of the old alias by pause or deletion, and sender reporting. Each closure applies to one address; other aliases are unaffected. General prevention sits in separate guides: the guide on how to stop spam emails covers the report and unsubscribe buttons, the guide on stopping spam emails in Gmail covers Gmail filters and blocks, and the guide on checking whether an email address was leaked covers the breach lookup that follows a leak.
Top comments (0)