I Got Doxxed Through My Real Email — So I Built a Free, Self-Hosted Email Aliasing Service on Cloudflare

I signed up for a job board I'd never heard of. The listing looked legitimate — "Senior Frontend Dev, Remote, $180K." I used my real Gmail address.

Two weeks later:

• 14 "recruiters" I never contacted were emailing me
• 3 phishing attempts disguised as interview invitations
• 1 data breach notification from HaveIBeenPwned
• My inbox was permanently polluted

My email was sold. Shared. Leaked. And there's no "un-leak" button.

I couldn't fix the past. But I could make sure it never happened again.

So I built GhostRelay — a self-hosted email aliasing service that generates unlimited masked addresses, all forwarding to your real inbox. When one gets compromised? Kill it. Your real address stays invisible forever.

The twist? It runs entirely on Cloudflare's free tier. No server. No monthly bill. No catch.

---

The Problem: Your Email Is Your Identity (And It's Everywhere)

Think about how many services have your real email right now:

• Every SaaS free trial you signed up for
• Every newsletter you subscribed to "just to get the PDF"
• Every conference registration
• Every sketchy WiFi captive portal
• Every online order
• Every forum account from 2014

Each one is a potential leak point. And when any of them gets breached, it's YOUR inbox that gets hammered.

The average person's email has been exposed in 5-7 data breaches (check yours at haveibeenpwned.com — I'll wait).

You can't control whether some random startup stores your email in plaintext. But you CAN control which email they have.

---

Introducing GhostRelay

GhostRelay gives every service a unique, disposable email address that forwards to your real inbox:

You sign up for SketchyJobBoard.com with:
  → [e-mail]

That alias forwards to:
  → [e-mail]

When jobboard-2025@ starts getting spam:
  → Delete the alias. Done. Zero leakage.

You never give out your real email again. Every service gets its own alias. When one is compromised, you know exactly which company leaked it (because only they had that alias).

It's email compartmentalization. The same principle as using separate passwords — but for your address itself.

---

How It Works (The Architecture)

The entire system runs on three free Cloudflare services:

Sender → [e-mail]
              │
              ▼
   ┌─────────────────────┐
   │  Cloudflare Email    │  ← Intercepts incoming mail (free)
   │  Worker              │
   └──────────┬──────────┘
              │
              ▼
   ┌─────────────────────┐
   │  Cloudflare KV       │  ← Looks up alias → destination mapping (free)
   │  (Key-Value Store)   │
   └──────────┬──────────┘
              │
              ▼
   ┌─────────────────────┐
   │  Forward to real     │  ← Your Gmail/Outlook/ProtonMail receives it
   │  inbox               │
   └─────────────────────┘

Dashboard (yourdomain.com/admin):
   ┌─────────────────────┐
   │  Cloudflare Pages    │  ← Static dashboard to manage aliases (free)
   └─────────────────────┘

No servers. No Docker. No VPS. No AWS. Just Cloudflare's free tier doing what it does best.

---

The Email Worker (Core Logic)

When mail arrives at any address on your domain, this Worker intercepts it:

export default {
  async email(message, env) {
    // Extract alias from recipient
    const recipient = message.to;
    const alias = recipient.split('@')[0].toLowerCase();

    // Look up in KV store
    const record = await env.ALIASES.get(alias, { type: 'json' });

    // Unknown alias — reject silently (no bounce = no confirmation to spammers)
    if (!record) {
      message.setReject("Unknown recipient");
      return;
    }

    // Check if alias is disabled
    if (record.disabled) {
      message.setReject("Alias disabled");
      return;
    }

    // Check if alias is expired
    if (record.expiresAt && Date.now() > record.expiresAt) {
      message.setReject("Alias expired");
      return;
    }

    // Forward to real destination
    await message.forward(record.destination);

    // Update stats (non-blocking)
    const stats = await env.ALIASES.get(`stats:${alias}`, { type: 'json' }) || { count: 0 };
    await env.ALIASES.put(`stats:${alias}`, JSON.stringify({
      count: stats.count + 1,
      lastReceived: new Date().toISOString(),
      lastSender: message.from,
    }));
  }
}

That's the entire forwarding engine. ~30 lines. Handles unlimited aliases. Runs at edge globally. Costs nothing.

---

The Dashboard

The web interface (hosted on Cloudflare Pages, also free) lets you:

• Create aliases — One click, or type a custom name
• Auto-generate random aliases — [e-mail] for maximum anonymity
• Label aliases — "Used for: LinkedIn", "Used for: Amazon", "Used for: that sketchy startup"
• View stats — How many emails each alias has received, last sender, last received date
• Disable aliases — Stop forwarding without deleting (in case you need it again)
• Delete aliases — Permanent. Gone. No more mail accepted.
• Set expiration — "Auto-disable this alias after 7 days" (perfect for free trials)
• Reply anonymously — Send emails FROM your alias without revealing your real address

---

The Comparison: GhostRelay vs. Every Paid Alternative

Here's what the market looks like in 2026:

Feature	SimpleLogin	addy.io (AnonAddy)	Firefox Relay	Apple Hide My Email	GhostRelay
Monthly cost	€4/mo (or €9.99 w/ Proton bundle)	$1-$4/mo	$0.99/mo (Mozilla VPN bundle)	Requires iCloud+ ($0.99-$12.99/mo)	$0
Annual cost	€48/yr (standalone)	$12-$48/yr	$11.88/yr	$11.88-$155.88/yr	$0
Free tier aliases	10	20 (shared domain)	5	0 (paid only)	Unlimited
Paid tier aliases	Unlimited	Unlimited	Unlimited	Unlimited	Unlimited (always free)
Custom domain	Paid only	Paid only	No	No	Yes (required, ~$10/yr)
Self-hostable	Yes (complex — Docker + Postgres + SMTP server)	Yes (complex)	No	No	Yes (15 min, no server)
Reply from alias	Yes	Yes	No	Yes	Yes
Alias labeling	Yes	Yes	No	No	Yes
Per-alias stats	Yes	Yes	No	No	Yes
Expiring aliases	No	No	No	No	Yes
Works if company dies	No (hosted) / Maybe (self-host)	No (hosted) / Maybe (self-host)	No	No	Yes (you own everything)
Setup complexity	5 min (hosted) / 2-4 hrs (self-host)	5 min (hosted) / 2-4 hrs (self-host)	2 min	Automatic	15 minutes
Infrastructure required	None (hosted) / VPS + Docker + DB (self-host)	None (hosted) / VPS + Docker (self-host)	None	Apple device	None (Cloudflare free tier)
Vendor lock-in	Proton ecosystem	Independent	Mozilla ecosystem	Apple ecosystem	None
Open source	Yes	Yes	No	No	Yes

The Key Differentiator

Every alternative falls into one of two camps:

Camp 1: Hosted services — Easy to set up, but you're paying monthly and trusting a company with your email routing. If they shut down, raise prices, or get acquired by someone shady, your aliases die.

Camp 2: Self-hosted (complex) — You own everything, but you need a VPS ($5-20/mo), Docker, PostgreSQL, an SMTP server, DNS configuration, TLS certificates, and ongoing maintenance. Most people give up halfway through setup.

GhostRelay is Camp 3: Self-hosted (trivial). You own everything, but the "server" is Cloudflare's free edge network. No VPS. No Docker. No database management. No TLS certificate renewal. No maintenance. Deploy once, forget it exists.

---

Why Not Just Use Gmail's "+" Trick?

Every tech blog suggests this: [e-mail] still delivers to [e-mail].

Here's why it's useless:

Problem	Why It Fails
Trivially strippable	Every spammer knows to remove everything after +. Zero protection.
Reveals your real email	[e-mail] still exposes [e-mail]
Many sites reject it	Sign-up forms often block + in email fields
Can't disable it	You can't "turn off" a + alias. It forwards forever.
No stats	No way to know how many emails a specific + address received

The + trick is security theater. It makes you feel protected while providing zero actual protection.

GhostRelay gives you completely unrelated addresses. [e-mail] cannot be reverse-engineered to your real email by anyone — not the service, not a hacker, not a data broker.

---

Real-World Usage Patterns

The "One Alias Per Service" Strategy

[e-mail]      → For LinkedIn
[e-mail]      → For Amazon
[e-mail]       → For GitHub notifications
[e-mail]      → For that SaaS free trial (expires in 7 days)
[e-mail]     → For event registrations
[e-mail]     → For that newsletter you might unsubscribe from

When sketchy-trial@ starts getting spam 3 months later? You know exactly who sold your data. Delete the alias. Problem solved.

The "Temporal Alias" Strategy

For things you only need briefly:

[e-mail]  → Airport captive portal (expires in 24 hours)
[e-mail]        → Figma trial (expires in 14 days)
[e-mail]       → One-time event (expires after event date)

Set an expiration. Forget about it. The alias auto-disables itself.

The "Identity Separation" Strategy

[e-mail]     → All freelance inquiries
[e-mail]    → Dating apps (privacy critical)
[e-mail]    → Banks and financial services
[e-mail]     → Healthcare providers

If your dating app gets breached, your banking email is untouched. Complete compartmentalization.

---

Self-Hosting Guide (15 Minutes, I Timed It)

What You Need

• A Cloudflare account (free)
• A custom domain (~$10/year from any registrar)
• 15 minutes

Step-by-Step

1. Add your domain to Cloudflare

Transfer your domain's nameservers to Cloudflare (or buy one directly from Cloudflare Registrar — cheapest option, no markup).

2. Enable Email Routing

In Cloudflare dashboard → Email → Email Routing → Enable. This tells Cloudflare to handle all email for your domain.

3. Create the KV Namespace

# Install Wrangler (Cloudflare CLI)
npm install -g wrangler

# Login
wrangler login

# Create KV namespace for aliases
wrangler kv:namespace create "ALIASES"

4. Deploy the Email Worker

git clone https://github.com/Tech-aficionado/GhostRelay---Open-Source.git
cd GhostRelay---Open-Source

# Update wrangler.toml with your KV namespace ID
# Deploy
wrangler deploy

5. Deploy the Dashboard

cd dashboard
npm install
npm run build

# Deploy to Cloudflare Pages
wrangler pages deploy dist

6. Set a catch-all email route

In Cloudflare dashboard → Email → Routing → Catch-all → Send to Worker → Select your GhostRelay worker.

Done. Every email to [e-mail] now hits your Worker. Create aliases through the dashboard.

---

Cost Breakdown: The Math That Makes Paid Services Embarrassing

Service	What You Get	Monthly Cost	3-Year Cost
Cloudflare Email Routing	Email interception + forwarding	$0	$0
Cloudflare Workers	100K requests/day free tier	$0	$0
Cloudflare KV	100K reads/day, 1K writes/day	$0	$0
Cloudflare Pages	Dashboard hosting	$0	$0
Custom domain	Your brand, your rules	~$0.83/mo	~$30
TOTAL	Unlimited aliases, full analytics, full control	$0.83/mo	$30

Compare to 3 years of SimpleLogin Premium: €144
Compare to 3 years of addy.io Pro: $144
Compare to 3 years of iCloud+: $35.64-$467.64

You save $100+ over 3 years AND own your infrastructure. The domain pays for itself.

---

Security Model

What GhostRelay Protects Against

• Data broker harvesting — They get a disposable alias, not your real address
• Credential stuffing — Even if a password leaks, the email is unique per service, making cross-site attacks harder
• Targeted phishing — If someone obtains a leaked alias, they can't determine your real inbox
• Spam avalanches — Kill one alias, all spam from that leak stops instantly
• Corporate data mining — Services can't cross-reference your activity across platforms via email

What GhostRelay Does NOT Protect Against

• Man-in-the-middle on Cloudflare — Cloudflare processes your email in transit (same as any email provider). For truly sensitive communication, use PGP/GPG.
• Your destination inbox being compromised — If someone hacks your Gmail, aliases won't help. Use 2FA.
• Legal requests — Cloudflare complies with valid legal orders. This is a privacy tool, not a crime tool.

Trust Model

You trust:

1. Cloudflare — To not read your email content in transit (they have no business incentive to, and their reputation depends on not doing so)
2. Your destination provider — Gmail/Outlook/ProtonMail processes your final mail
3. Yourself — You control the Worker code, the KV data, the domain

You do NOT trust:

• Any third-party SaaS email aliasing company
• Any database you don't control
• Any service that could disappear or raise prices

---

FAQ

Q: What if Cloudflare cancels the free tier?
A: The Worker code is portable. Deploy to AWS Lambda, Deno Deploy, or any edge runtime in an hour. Your aliases are exportable as JSON. You're not locked in.

Q: Can I use this with ProtonMail as my destination?
A: Yes. The destination can be any email address. ProtonMail, Tutanota, Gmail, Outlook — anything that receives email.

Q: What about sending/replying FROM an alias?
A: Supported. Cloudflare Email Workers can route outbound mail too. Reply to an email and it appears to come from the alias, not your real address.

Q: How many aliases can I create?
A: Unlimited. KV's free tier handles 1,000 writes/day. Unless you're creating 1,000 aliases per day (you're not), you'll never hit the limit.

Q: Does this work with catch-all?
A: Yes. You can either create explicit aliases OR enable catch-all mode where ANY address at your domain forwards to you. Catch-all is simpler but means you can't "disable" a specific alias without adding deny rules.

---

The Source

• GitHub: github.com/Tech-aficionado/GhostRelay---Open-Source
• License: MIT
• Stack: JavaScript (49.2%) + CSS (27.8%) + HTML (23.0%)
• Infrastructure: 100% Cloudflare free tier
• Setup time: 15 minutes
• Ongoing maintenance: Zero

---

Final Thought

Your email is the master key to your digital life. Every password reset, every account recovery, every two-factor backup — it all routes through your inbox.

And you've been giving that master key's address to every random service with a sign-up form.

GhostRelay doesn't fix the past. Your email is already in a dozen breach databases. But it fixes the future. From today, no service ever gets your real address again.

Every interaction gets its own disposable alias. Every leak is contained. Every spam wave is killable with one click.

Your real inbox becomes a fortress that nobody can find — because nobody has the address.

Deploy GhostRelay. Give out aliases. Sleep better.

---

Check haveibeenpwned.com right now. How many breaches is your email in? Drop the number in the comments (no judgment — mine was 11 before I built this). Then deploy GhostRelay so that number never grows again.

---

Built by Shivansh Goel — AI & Full Stack Developer who believes privacy shouldn't cost a monthly subscription.

---