Email forwarding and address lookup: what it leaks, and how to forward privately
Forwarding rules, catch-all addresses and public lookups quietly expose who you are and where your mail lands. Here is how forwarding works, what is visible, and how to keep it sealed.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.
Forwarding is a routing decision, and routing is public-ish When mail is forwarded, the message is delivered to one server and re-sent to another. Every hop adds headers. Anyone who receives the final message can usually reconstruct the path, and any server along the way holds a readable copy for as long as it processes the message.
That is the part people miss when they set a forwarding rule "for privacy": the rule adds a reader, it does not remove one.
What an address lookup can reveal Public DNS answers questions about a domain: which servers accept mail (MX), which senders are authorised (SPF), how signatures are validated (DKIM) and what to do with failures (DMARC). None of that reveals message content, but it does reveal your provider, your infrastructure choices and often your aliases if a catch-all is misconfigured.
Two consequences worth acting on: - A catch-all address turns every guessed alias into a valid target, which is how address harvesting starts. - Weak or missing authentication records make it easy for others to send mail that appears to come from you.
Forwarding privately: the right order 1. **Terminate forwarding at a zero-access mailbox.** The last hop should be a provider that seals the message on arrival, so the readable copy stops existing at that point. 2. **Use per-purpose addresses instead of a catch-all.** One address per service means you can retire the noisy ones without changing your identity. 3. **Separate the public-facing domain from the professional one.** Signup addresses attract spam and reputation damage; your client-facing address should not share that surface. 4. **Publish complete authentication records** so nobody can impersonate your domain, and so your legitimate mail is not treated as suspicious.
What DRIVUNO does at the last hop Inbound messages are encrypted at ingestion to your public key. The stored archive is ciphertext, searchable through blind indexes computed on your device. Attachments are sealed with the message and can be saved directly to your encrypted drive. Nobody on our side can read the archive that forwarding produced.
A quick self-audit - Do I have any forwarding rule pointing at a mailbox someone else can read? - Is my catch-all necessary, or is it just an open door? - Which of my public addresses could be retired without breaking anything?
Forwarding is a useful tool. Just make sure the last stop is a mailbox that cannot read you.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.