Isn't having your own domain name for email very bad for privacy? And how do you pick a good domain name that doesn't sound goofy?

After the Proton CEO twitter scandal, I'm thinking of getting a domain that I own. But problem is, all my email address would be @mydomainname.com instead of @protonmail which millions of people use. Isn't that just linking all your account together. Even if you create a separate email address for every account, they all still identify to your domain and the surveillance corporations can link your accounts together to your identity. So I'm not sure about having own domain name...

🤔

And its hard to even pick a name that sound good when you say it like Pro-ton-mail is easy to pronounce, I can't think of some good domain name like that to choose.

17 comments

Privacy: having your own domain is great, you can give every service you use a different email address. You have lots of privacy. It's more work for them to correlate across accounts. If there's a email leak, you just block that one address
Anonymity: none. Anybody who really wants to figure out who owns the email is not going to have a lot of work to do.
You can have your own domain, use it for things you don't mind identifying yourself for. And then for disposable things you don't want linked to your identity, you can use other email services
- The answer is have two domains one for things you want to identify yourself as and one you don't they can go to the same mailboxes even just make the catch all and domain alias for both. If email provider is trusted then your config is not shown to the outside the provider.
  
  if you systematically use one domain for anonymous things, you will tie all those anonymous actions to that domain and effectively dox yourself.
  If you want to be anonymous you don't want any pattern to be predictable across identities.

Even if you create a separate email address for every account, they all still identify to your domain and the surveillance corporations can link your accounts together to your identity. So I’m not sure about having own domain name…
Have your own domain for email relationships that already have to know who you are because of the nature of the email. This is the email box/account you actively monitor. Have another "leaky" free email account not attached to your name (hotmail, gmail, etc) that you send garbage to that you need to be able to receive email from, but that you don't actively monitor.

I have my last name and a suffix, so I can share it with family. But my dad just can't wrap his head around the @ between his first and last name. So many aliases for him.

Good questions!
But problem is, all my email address would be @mydomainname.com instead of @protonmail which millions of people use. Isn’t that just linking all your account together.
I mean, yeah. You can't setup sockpuppets on the same service. It'll be obvious it's the same person. And if someone is tracking you across services, it'll be way easier to find you. This is a con.
I would recommend not picking a domain with your real name, like smith.com or john.com. Even though it does seem popular to have me@johnsmith.com. It won't solve the issue you noticed, but it'll mitigate it a tiny bit.
its hard to even pick a name that sound good
Also, true. Ideally, you pick a common word with normal spelling that doesn't have a homophone that's not embarrassing to say to random people on the street. It would be awkward to be applying to a job or a loan and have to say your email is "john@piggy.park". Also, you will have to speak your email over the phone at some point, the shorter and easier it is the better.
I would also recommend picking a domain with either .com or .net TLDs. Some companies blanket destroy your email if it comes from some weird TLD like ".party" or ".xyz". Omg, specifically, .xyz I think has been linked to tons of spam. Bigger companies will handle this more gracefully (put it in spam). But smaller companies, like my local garbage company run by normies, will just not deliver the email. (And debugging why emails don't get received is really hard and annoying.)
Unfortunately, a lot of people squat domains, so finding a short, simple, easy domain is really hard. I'm curious what other people do. Maybe other people just have me@reallylongdomainthaticanactuallyget.com? Or maybe other people have had better experience with john@mail.club? Or maybe some people don't care that their domain is john@boss.baby?
Ultimately though, having email independence is valuable enough for some folks to be OK with the downsides.

I know a lot of people with their own domain names and email servers. From a privacy perspective, it is better because you know nobody is reading your emails. Your email address is a method to track regardless. But free email services are only free because they scrape your emails to figure out which ads to send. If you run your own mail server, you know no one is snooping.
The real issue is that you need to be fastidious about security, because your servers are exposed to the broader Internet and there are a lot of bad actors. You not only have to make sure your server doesn't get hacked, but you also need to make sure the mail server application can't act like an open relay. Spammers use misconfigured mail servers all the time to send tons of spam messages using someone else's bandwidth.
And once your mail server is used as a spam relay, it might get IP blocked from major email providers, and I bet that is a pain to get resolved.
So it's only worth it if you know what you are doing.
- The real issue is that you need to be fastidious about security, because your servers are exposed to the broader Internet and there are a lot of bad actors. You not only have to make sure your server doesn’t get hacked, but you also need to make sure the mail server application can’t act like an open relay. Spammers use misconfigured mail servers all the time to send tons of spam messages using someone else’s bandwidth.
  I'm planning on just using a encrypted mail provider and just using the custom domain, so I don't have to actually manage the email myself.
- you know nobody is reading your emails
  Can't they be read by someone who's compromised whatever server the other person is using? Since email isn't encrypted, couldn't anyone who picked up the traffic on the way to your server also read that email?
  
  Yes, essentially, an email is the digital equivalent of a postcard.
  
  Yeah, individual emails can be picked off at any point in the chain while in transit. And someone who has hacked key infrastructure in front of your server can see all emails on transit. But your server might have stored emails, so someone with clandestine access to that will be able to access part of your email history (perhaps all of it, if you use that server for permanent email storage), and they are not limited to emails in transit.

But problem is, all my email address would be @mydomainname.com instead of @protonmail which millions of people use.
<anyname>
@uniquename.com is, roughly, the privacy equivalent of uniquename@protonmail.com. You don't gain any significant amount of privacy by being a uniquely-identifiable part of a large mob than in registering yourself as a small, uniquely-identified mob.

Buy domain with monero. Stand up I2P, route email through that. You cannot be completely untraceable. But you can try the best you can.
https://defronix.com/what-is-i2p-and-how-to-setup-it/
https://github.com/i2p/i2p.i2p-bote
https://cryptwerk.com/companies/domains/xmr/

Buy two domains at least. One for the actual email and one for redirection email addresses with something like addy.io .
In the UK, open personal details can be resisted from whois listings under data protection, but you can use a mailbox or office address to make that a redirect.
I use a control domain to control all my other customer domains and I separate DNS, domain hosting, email, and websites so no-one has too much control. That was a painful lesson to learn.
Picking domain names is hard. Whatever you pick it will sound silly or it's already been taken. Just make it easy to spell and short to reduce the pain of spelling it out, and these days LLM tools can help choose.

And its hard to even pick a name that sound good when you say it like Pro-ton-mail is easy to pronounce, I can't think of some good domain name like that to choose.
I did a 4 letters domain .me
That way it’s quick and easy to say, letters by letters dot me. Usually using your initials (generally 2 letters) + ISO 3166-1-alpha2 letters country code works well.
So if you are Fidel Castro from Cuba your domain would be FCCU.me

If you are concerned about privacy concerns with respect to having multiple addresses all under the same domain. My thought is that most scripts for handling any automation of email address exploitation likely treat each address separately until they can link two or more identities together. If you wrote some general logic to handle parsing millions of email addresses how would it know that jimbob@mydomain.com is also apple_account@mydomain.com. Sure a human could look and probably make the relation that yes those could be the same person if mydomain.com was something like myname.com but what would that rule or logic look like? How do we discern mydomain.com from myname.com from somerandomname.org in any automated fashion so that we can then say with some degree of certainty that all the addresses under that domain are the same person. At best I would expect you to have them all just linked to that domain/organization. You could do further logic to attempt to link domains to people but thats still going to be complicated. When it comes to security its all about gauging the threat and taking sufficient action to negate that threat.

I made a separate Gmail to forward to my main email inbox. While the corporations and stuff get whatever@wasnteatingchips.com, anyone in person or over the phone gets bernadettelastname@gmail.com

17 comments