---
title: When an alias leaks
updated: 2026-10-15
summary: How Yellowbird spots a leak and what you can do about it.
section: Aliases
order: 1
---

Every alias is given to one company. If mail arrives from anyone else, the alias has leaked: that company shared or lost your address.

[Custom aliases](/help/aliases#custom-aliases) aren't given to a company, so they take mail from anyone and never leak.

## How a leak is spotted

Mail to an alias is expected when it's from the company you gave it to, a company you've trusted on that alias, or one of their subdomains, and the sender passes email authentication. Anything else is marked **Unexpected sender**.

The first unexpected sender marks the alias **Leaked**, and Yellowbird records who it was and when. Bounces and out-of-office replies to mail you sent don't count. A bounce for mail you never sent does: it means someone else used the alias as their From address.

Anyone can put a company's name on an email. If the unexpected sender fails email authentication, Yellowbird says mail _claiming_ to be from them reached the alias, rather than naming them as the leaker, and doesn't send a leak notification. If an authenticated stranger writes in later, the leak is updated to name them.

## What you can do

When an alias leaks, you'll see three choices:

- **Block the sender**: stop mail from that sender's domain to this alias. The company you gave it to can still reach you.
- **Replace this alias**: make a new address for the same company and block the old one. See [Blocking and replacing aliases](/help/blocking-and-replacing-aliases).
- **It's fine**: trust that sender's domain on this alias, for when a company writes from more than one domain, like amazon.com and amazon.co.uk. Their mail stops counting as a leak, and if nobody else was unexpected, the alias goes back to normal. Personal mail domains like gmail.com can't be trusted.
- **See alias history**: everyone who's written to the alias, and when. You can trust an unexpected sender from there too, and stop trusting one later.

You can turn on [notifications](/help/notifications) to hear about leaks as they happen.