Shared Inboxes Without Shared Passwords: Email Aliases for Teams

Your company has info@, support@, and sales@ addresses. Multiple people need to see those emails. The lazy solution: share the password. The secure solution: do not.

Why password sharing is a problem

• 2FA becomes impossible — You cannot enable two-factor authentication on an account whose password is shared across 5 people
• No accountability — When someone deletes an important email, you do not know who
• Offboarding nightmare — When someone leaves, you have to change the password and redistribute it to everyone else
• Credential leaks — Shared passwords end up in Slack messages, sticky notes, and shared docs

Method 1: Multi-destination aliases

Create an alias (e.g., support@yourdomain.com) and configure it to forward to multiple personal mailboxes. Each team member receives a copy in their own inbox. No shared credentials needed.

In Cleanbox, you can achieve this with filter rules: create a filter with action Allow and add multiple addresses in the forward_to option. The original message is delivered to the linked mailbox, and copies are forwarded to additional team members.

Method 2: Cleanbox Teams

For more control, use Cleanbox Teams:

1. Create a team in Cleanbox
2. Invite team members with their own accounts
3. Set granular permissions — who can see messages, who can manage aliases, who can change settings

Each member logs in with their own credentials, with their own 2FA. The team shares access to aliases, contacts, and messages — not passwords.

Permission levels

A support agent might get read access to messages and contacts, but no access to billing or domain settings. An IT admin might get full access. You control exactly what each person can see and do.

Method 3: Gmail "delegate access"

If you use Google Workspace, you can delegate access to a mailbox without sharing the password:

1. Settings → Accounts → "Grant access to your account"
2. Enter the delegate's email address
3. The delegate can read and send from the shared mailbox using their own Gmail login

Limitation: Gmail delegation gives full read/write access — no granular permissions. And it only works within the same Google Workspace organization.

Which method when?