Using Gatekeeper mode for maximum protection

Gatekeeper is the strictest Shield feature. When enabled on an alias, only approved senders can deliver email to it. Everyone else is automatically rejected. There are no exceptions — if a sender isn't on the approved list, their message is blocked.

When to use Gatekeeper

Gatekeeper is designed for aliases where you want absolute control over who can reach you:

• Personal aliases — An alias shared only with close friends or family. No spam, no strangers, ever.
• Financial aliases — An alias used exclusively with your bank, accountant, or payment provider. Any email from an unknown sender is suspicious by definition.
• Client-specific aliases — A dedicated alias for one business client. Only they should be able to email it.
• High-security aliases — An alias tied to sensitive accounts where phishing is a real concern.

Setting up Gatekeeper

1. Open the alias and go to the Shield tab
2. Enable Gatekeeper
3. Add your first approved sender
4. Save

Important: The moment you enable Gatekeeper, all messages from non-approved senders are rejected. Make sure you add your approved senders before or immediately after enabling it.

Managing approved senders

Adding a sender

1. On the Shield tab, find the Gatekeeper section
2. Click "Add approved sender"
3. Enter the email address (e.g., john@example.com)
4. Save

You can add as many approved senders as you need. There is no limit.

Removing a sender

Click the remove button next to the sender's address. Their emails will be rejected immediately after removal.

Approved sender formats

Format	What it allows
john@example.com	Only this specific address

What happens to rejected messages

When a non-approved sender emails a Gatekeeper-protected alias:

• The message is rejected immediately
• It does not appear in your inbox, quarantine, or message history
• The sender may receive a bounce notification from their email provider
• No notification is sent to you

This is intentional — Gatekeeper is a whitelist-only mode. If you want to be notified about rejected messages, consider using a filter with a block action instead, which logs the message as "denied" in your history.

Gatekeeper vs. contact whitelist

Both Gatekeeper and contact whitelisting control sender access, but they work differently:

	Contact whitelist	Gatekeeper
Scope	All aliases	Per alias
Non-listed senders	Processed normally (spam check, filters)	Rejected immediately
Use case	Prioritize trusted senders across all email	Lock down a specific alias completely

You can use both simultaneously. A whitelisted contact sending to a Gatekeeper alias still needs to be on the Gatekeeper's approved list.

Combining Gatekeeper with other Shield features

Gatekeeper can be combined with Rate Limiter and Delivery Snoozer for layered protection:

Gatekeeper + Rate Limiter

Only approved senders can email the alias, AND there's a cap on volume. Useful when even a trusted sender might flood your inbox (e.g., an automated system from a partner).

Gatekeeper + Snoozer

Only approved senders can email the alias, AND messages are only delivered during specific hours. Useful for a work alias that should only be active during business hours, even from trusted contacts.

All three combined

Maximum protection: only approved senders, volume-limited, and time-restricted. This is the most controlled an alias can be — ideal for high-security use cases.

Common setup patterns

Family-only alias

• Gatekeeper: enabled
• Approved senders: family members' email addresses
• Rate limiter: off (family won't spam you)
• Snoozer: off (you want family emails anytime)

Banking alias

• Gatekeeper: enabled
• Approved senders: your bank's notification addresses
• Rate limiter: 10/day (safety net against automated floods)
• Snoozer: off (financial notifications should arrive immediately)

Work client alias

• Gatekeeper: enabled
• Approved senders: client team email addresses
• Rate limiter: off
• Snoozer: Mon–Fri, 08:00–18:00 (no work email on weekends)