addy.io

Azure Security 1 variation

addy.io, an open source self hosted email aliasing service, secured on first boot.

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Variations

This product is available in the build below. Open it for the operating system, cloud and version detail, or read its deployment guide.

ProductCloudOperating systemVersion
addy.io on Ubuntu 24.04 Azure Ubuntu 24.04 Standard View · Guide

Overview

addy.io, formerly AnonAddy, is a self hosted email aliasing service. Instead of giving your real address to every shop, forum, newsletter and app, you give each one a different alias on your own domain. Mail sent to an alias is forwarded to your real inbox and you can reply from the alias, so the other side never learns where it lands. When an alias starts attracting spam you switch it off, and only that one correspondent is affected. Because each alias is unique to one recipient, an address that starts receiving spam tells you exactly who leaked or sold it.

Why the cloudimg image

Upstream ships with sign up open and no concept of an owner, so on a public address any passer by can create an account and issue aliases on your domain. The cloudimg image seeds exactly one administrator with a password generated on your machine and closes registration before either the web or the mail listener opens. The application key, database and Redis passwords, verification secret, blocklist API secret and DKIM key are all generated per instance, including the one real secret upstream commits to its public repository. A guard refuses to start either public listener on an empty, unrotated or published default value. Paired deploy guide and 24/7 cloudimg support.

Common uses

  • Give every website its own disposable email alias
  • Trace and cut off whoever leaked or sold your address
  • Run alias based anti spam on infrastructure you control