Email aliases and Hide My Email: should you block relay addresses?

A relay alias is a unique email address that forwards to a person's real inbox. Services such as Apple's Hide My Email, Firefox Relay, DuckDuckGo and SimpleLogin create one for each site, so the site never learns the real address. A real person reads the mail, which is why most sites should accept these addresses. The risk is volume, because one person can create many aliases and claim a free trial again and again.

#How does a relay address work?

1. The user signs up with a relay service once, with their real inbox.
2. At a signup form, the service creates a new random address for that site. On an iPhone, Hide My Email offers one above the keyboard in supported apps.
3. Mail sent to that address goes to the real inbox. Firefox Relay calls these "masked, or private, email addresses that forward messages to your true email address".
4. With Sign in with Apple, the address ends in @privaterelay.appleid.com, and only the app or site that created the account can use it to reach the user (Apple Support).

The site gets a working address and a real reader. What it loses is the link between accounts, because each site sees a different address for the same person.

#Which services create relay addresses?

In the US, people search for SimpleLogin most often of the five services below, followed by Apple's Hide My Email and Firefox Relay (Keyword Planner, October 2026).

Some services police abuse themselves. addy.io's terms say "you must not use addy.io to create large numbers of accounts on other websites/services", and Firefox Relay rate-limits how many masks one user can create in a day.

#How do relay addresses show up in a signup check?

A check can tell a relay apart from a throwaway inbox. On October 23, 2026, FFraud's free email API answered test addresses at Firefox Relay, SimpleLogin, 33mail and Apple's relay with email_type: "alias". A Mailinator address came back as temp, and gmail.com sits on a safe list and is never marked disposable.

curl -X POST https://api.ffraud.com/public/email/check \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

The flag is_disposable stays true for both relays and throwaways, so read email_type when you want to treat them differently (email API docs).

#Should you block relay addresses?

For most signups, no. The person behind a relay reads the mail, and blocking the address turns away people who simply value their privacy. The case for care is multi-accounting. A 2026 study found attackers using aliases to create up to 139 accounts from one base email on npm. It also notes that an abuser can keep registering alias accounts "to continuously exploit free trial offers" (Wu et al., NDSS 2026).

Throwaway inboxes are a different case, because they are abandoned after one use. The guide to disposable email addresses covers when to block those.

#What is a relay alias confused with?

Gmail delivers [email protected] to the same inbox (Gmail Help), and a Google Workspace admin can add an alternate address to a user's mailbox. Providers handle these rules unevenly: of 28 providers studied, only Gmail fully documents its aliasing rules, and 11 support alias behaviors they do not document (Wu et al., NDSS 2026).

#Questions people ask

To see how any address is classed, check it with the free email checker.