When an alias leaks

Every alias is given to one company. If mail arrives from anyone else, the alias has leaked: that company shared or lost your address.

Custom aliases aren't given to a company, so they take mail from anyone and never leak.

How a leak is spotted

Mail to an alias is expected when it's from the company you gave it to, a company you've trusted on that alias, or one of their subdomains, and the sender passes email authentication. Anything else is marked Unexpected sender.

The first unexpected sender marks the alias Leaked, and Yellowbird records who it was and when. Bounces and out-of-office replies to mail you sent don't count. A bounce for mail you never sent does: it means someone else used the alias as their From address.

Anyone can put a company's name on an email. If the unexpected sender fails email authentication, Yellowbird says mail claiming to be from them reached the alias, rather than naming them as the leaker, and doesn't send a leak notification. If an authenticated stranger writes in later, the leak is updated to name them.

What you can do

When an alias leaks, you'll see three choices:

• Block the sender: stop mail from that sender's domain to this alias. The company you gave it to can still reach you.
• Replace this alias: make a new address for the same company and block the old one. See Blocking and replacing aliases.
• It's fine: trust that sender's domain on this alias, for when a company writes from more than one domain, like amazon.com and amazon.co.uk. Their mail stops counting as a leak, and if nobody else was unexpected, the alias goes back to normal. Personal mail domains like gmail.com can't be trusted.
• See alias history: everyone who's written to the alias, and when. You can trust an unexpected sender from there too, and stop trusting one later.

You can turn on notifications to hear about leaks as they happen.