Glossary
Email privacy terminology — encryption, metadata, aliases, and the protocols underneath.
Canonical version maintained at anonguide.com.
C
- Catch-All Address deliverability #
-
A custom-domain configuration where every address at that domain is delivered to the same mailbox, letting you invent per-service addresses on the fly ("[email protected]"). Powerful for tracking who leaked your address.
See also: Email Alias
E
- Email Alias deliverability #
-
A forwarding address used at signup so your real address never reaches a service. Lets you disable the alias if it starts attracting spam or shows up in a breach.
See also: forward-only, Catch-All Address
- End-to-End Encryption encryption #
-
Encryption from sender's device to recipient's device, with no decryptable copy at any server in between. For email, this means OpenPGP, S/MIME, or a custom protocol (Proton Mail's, Tutanota's).
See also: transport-encryption
M
- Metadata concepts #
-
Email's envelope and headers — From, To, Subject (in most E2EE systems), Date, Received-by hops. Even E2EE email leaks this. Tutanota encrypts subject lines as well; Proton and others do not.
See also: End-to-End Encryption
- MTA-STS transport #
-
Mail Transfer Agent Strict Transport Security. A DNS-and-policy mechanism that requires TLS between mail servers when both sides advertise support, defeating opportunistic downgrade attacks. Worth deploying on any custom domain.
O
P
- Plus-Addressing deliverability #
-
Most providers route "user+anything@domain" to user@domain. Useful for one-off signups but easy for spammers to strip back to the base address — alias services are stronger.
See also: Email Alias
S
- S/MIME encryption #
-
The X.509-based alternative to OpenPGP, used mostly inside enterprises with their own PKI. Native client support is wider than PGP (Outlook, Apple Mail), but identity is rooted in CA-issued certificates rather than a web of trust.
See also: OpenPGP
- SPF / DKIM / DMARC deliverability #
-
The three email-authentication standards. SPF authorizes sending IPs, DKIM cryptographically signs outbound mail, DMARC tells receivers what to do with messages that fail. Every custom domain needs all three set correctly to land in inboxes.