Privacy-First Email: A Guide for the Paranoid (and the Practical)

Not everyone needs the same level of email privacy. A teenager signing up for social media has different needs than a journalist protecting sources, who has different needs than a corporate whistleblower. But everyone needs some level of protection.

This guide is structured in three tiers. Start with Tier 1 (everyone should do this), add Tier 2 if you are privacy-conscious, and go full Tier 3 if you have specific threat models. Each tier builds on the previous one.

Tier 1: Essential hygiene (everyone)

These are the basics. If you do nothing else, do these five things.

1. Use a unique password for your email account

Your email is the master key to your digital life. If someone accesses your email, they can reset every other password. Use a long, unique password (16+ characters) stored in a password manager. Never reuse your email password anywhere.

2. Enable two-factor authentication

Use an authenticator app (Google Authenticator, Authy, 1Password) — not SMS. SMS can be intercepted via SIM swapping. Save your backup codes in a secure location.

3. Do not click links in emails for login

When an email asks you to log in, reset your password, or verify your account, navigate to the service directly by typing the URL. Never click the link in the email. This single habit prevents most phishing attacks.

4. Unsubscribe from lists you do not read

Every mailing list is a company that has your email address. The more lists you are on, the higher the chance one of them gets breached or sells your data. Regularly prune your subscriptions.

5. Be selective about who gets your email

Before entering your email address on a website, ask: "Do I trust this company with my email for the next 10 years?" If not, do not give them your real address.

Tier 2: Privacy-conscious (recommended)

You understand the risks and want to minimize your exposure without making email unusable.

6. Use email aliases for every service

This is the single biggest upgrade from Tier 1. Instead of giving your real address to every website, create a unique alias for each one:

• shop-amazon@cleanbox.me for Amazon
• social-linkedin@cleanbox.me for LinkedIn
• bank-chase@cleanbox.me for your bank

Benefits:

• If a service is breached, only that alias is exposed
• You can identify exactly which service leaked your data
• Disable any alias with one click — spam stops instantly
• Your real address never appears in any company database

7. Use a custom domain for aliases

Using @cleanbox.me aliases works, but some services block known alias domains. With a custom domain (@yourdomain.com), your aliases look like regular email addresses. No service will block them, and you control the domain forever.

8. Separate email by purpose

Maintain at least three email identities:

Identity	Used for	Protection level
Personal	Friends, family, important accounts	Real address or permanent alias. 2FA required.
Commercial	Shopping, subscriptions, services	Unique alias per service. Disable when spammy.
Throwaway	One-time signups, free trials, downloads	Random alias. Expect to disable quickly.

9. Disable remote image loading

Tracking pixels in emails reveal your IP address, location, device, and reading habits. Disable remote image loading in your email client settings. When you need to see images in a specific email, load them manually for that message only.

10. Check Have I Been Pwned regularly

Enter your email addresses at haveibeenpwned.com periodically. If any appear in a new breach, rotate passwords and consider retiring that address.

Tier 3: Maximum privacy (threat-model dependent)

This tier is for people with specific threats: journalists, activists, executives in targeted industries, or anyone who has a reason to believe they are being individually targeted.

11. Use a privacy-focused email provider

Mainstream providers (Gmail, Outlook) scan your email for advertising and can be compelled to hand over data to governments. Privacy-focused providers offer end-to-end encryption:

• ProtonMail — Swiss jurisdiction, zero-access encryption, open source
• Tuta (Tutanota) — German jurisdiction, end-to-end encryption

You can use these as your primary mailbox and still use Cleanbox aliases for inbound email management.

12. Hardware security keys

Authenticator apps are good. Hardware keys (YubiKey, Google Titan) are better. They are immune to phishing because they validate the actual domain during login — a fake login page cannot capture the key response.

13. Compartmentalize by threat level

Use completely separate email providers for different identities:

• Legal/official identity — Your real name, real domain, privacy-focused provider
• Online identity — Pseudonymous, different provider, different device
• Sensitive communications — End-to-end encrypted provider, accessed only via VPN or Tor

Never cross-link these identities. Do not use the same password manager entry, the same browser profile, or the same IP address for different compartments.

14. Use Shield Gatekeeper for sensitive aliases

For aliases tied to your most sensitive accounts, enable Gatekeeper mode. Only pre-approved senders can deliver email to that alias. Even if the address leaks, unknown senders are silently rejected.

15. Own your domain with WHOIS privacy and DNSSEC

• WHOIS privacy — Hides your name, address, and phone number from public domain records
• Domain lock — Prevents unauthorized domain transfers
• DNSSEC — Prevents DNS spoofing attacks that could redirect your email to an attacker server

The privacy spectrum

Tier	Effort	Protection against
Tier 1	30 minutes one-time	Credential stuffing, basic phishing, password reuse
Tier 2	2-3 hours setup, 5 min/week maintenance	Data breach exposure, tracking, spam, identity correlation
Tier 3	Ongoing discipline	Targeted attacks, surveillance, legal discovery, state actors

Most people are well-served by Tier 1 + selected items from Tier 2. Full Tier 3 involves trade-offs in convenience that are only justified by specific threat models. The key is to honestly assess your risks and choose the appropriate level — doing too little leaves you vulnerable, but doing too much makes email unusable.

Start where you are. Every step up from your current level is a meaningful improvement.