Addresses on your domain
Up to ten addresses, the catch-all, putting them on your encryption key, sending from them, and publishing them in the key directory.
An address on your own domain is an extra address for your mailbox. Mail to it arrives here, you can send from it, and it can go on your encryption key so other people's mail programs find your key by that name.
A Plus subscription allows up to ten addresses on your domain, plus a catch-all that covers every other name.
Making an address
- Open Settings → Your domain. The Addresses section lists what you have, and Add an address opens the form.
- Type the part before the
@. Letters, digits and dots, at least one letter, no dot at either end and no two dots together — up to 64 characters.hello,first.lastandsales2are all fine. The screen refuses anything else before it asks us. - Give it a name shown to recipients, if you like. This is what appears beside the address in other people's mail clients, and it can differ per address — your own name on one, a company name on another.
- Decide whether it is your default sender. At most one address is; with none chosen, your main Private.Ki address is the default.
- Press Create address. It starts receiving immediately, as long as the domain is Receiving.
There are no reserved names and no minimum length on your own domain: a.b, postmaster and admin are yours to take. Removing an address is on its own page, and it stops receiving at once.
+tag works here as it does everywhere on Private.Ki: mail to [email protected] reaches the hello address, tag intact in the stored headers. See Sub-addressing — nothing about it is different on your own domain.
The catch-all
The Catch-all switch decides what happens to a name you never created.
On — every other address on the domain delivers to this mailbox. [email protected], [email protected], a typo of your own name: all of it arrives. Nothing is created and nothing appears in your address list; the mail simply comes to you.
Off — a name you have not created is refused at the door, immediately, with "No such address at this domain." The sender is told at once rather than waiting for a bounce later.
This is the honest trade-off, and it is the opposite of how a Private.Ki domain behaves: on our own domains we never confirm whether an address exists. On your domain, with the catch-all off, somebody trying names one by one learns which ones are real.
Catch-all on gives nothing away — every name answers the same. Catch-all off keeps your mailbox free of mail addressed to names you never made. It is your domain, so it is your choice; neither setting affects encryption or anything already in your mailbox.
A catch-all address is a delivery rule, not an identity. You cannot send from one, and it is never published in the key directory — only addresses you actually created can be either of those things.
Putting an address on your key
You have one encryption key, and the addresses on it are the names other people can look up to write to you encrypted. A new address is not on it until you say so.
- Open the address, under Addresses, and press Add this address to your key.
- Your device does the work. The address is added to your key as a new name, and only the public half is sent to us. Your private key never leaves the device.
- The address is now on your key. Encryption keys on this domain on the domain page lists which of your addresses are on it.
Adding an address adds a name to the key you already have. The key itself — its fingerprint, and everything encrypted to it — is untouched: mail already in your mailbox stays readable, and nobody has to fetch your key again. We check this when the key is uploaded: a key whose fingerprint has changed, or one that no longer names your main Private.Ki address, is refused.
Publishing to the key directory
An address on your key can also be published, which means another mail program can ask DNS for your key by that address and encrypt to you on the first message — no exchange, nothing to send first. How it works is in Automatic key discovery.
Publishing an address on your own domain needs four things to line up, and the address page shows you which are missing:
| Needed | Where it comes from |
|---|---|
| The domain is Receiving | Your MX record |
The openpgpkey CNAME is in place |
One of the four optional records in DNS records |
| The address is on your key | Add this address to your key, above |
| Publishing is switched on for the address | The switch on the address page |
With all four, the address page reads Published for encryption. Turn the switch off and the address stops being answered immediately — mail still arrives, and your key keeps the name; it is only the public lookup that stops. Publishing is per address, so you can publish hello@ and keep another address out of the directory entirely.
The same thing that is published for your main address: your public key. It is public by its nature — it is what people use to write to you, and it can only encrypt, never decrypt. Nothing about your mailbox, your other addresses or your account goes with it.
Sending from an address
Once an address exists, it joins the list of addresses you can send from. In the composer, the From line becomes a chooser as soon as you have more than one; with one it stays as it is.
Your default sender is used for new messages: the address you marked as default, or your main Private.Ki address if you marked none. Changing the default is one switch on the address page, and at most one address is ever the default.
The technical identifiers on a message you send from your domain name your domain, not ours — a recipient reading the raw headers of mail from [email protected] sees your domain throughout.
If your subscription ends and the domain pauses, sending from its addresses stops at once — before incoming mail is affected. Your main Private.Ki address keeps working, and your drafts keep their text; change the From line to send. See Your own domain for what pausing does.
What the server can see
Cannot see
- Anything inside mail that arrives at them — subjects, bodies and attachments are encrypted to your key exactly as on your main address
- Who writes to a catch-all address, as a list of names you own — a catch-all is one rule, not an address per name
Can see
- The addresses you create on your domain — they are the names the mail server has to match when mail arrives, so they are held as plain text
- Your domain name, its state, and which addresses are published for encryption
What this version does not do
- No addresses for other people. Every address on your domain belongs to your account. There are no members and no invitations, and nobody else can be given one.
- No sign-up or sign-in on your domain. Not for you, not for anybody. Your account is still the one you created.
- No more than ten addresses, plus the catch-all.
Does a new address get its own key?
No, and it should not. You have one key and the address becomes another name on it, so everything written to any of your addresses is readable with the same key.
Can I send from a catch-all address?
No. Only addresses you created can send, and only those can be published. If you want to send as [email protected], create it as an address.
What happens to mail if I remove an address?
Mail already received stays in your mailbox and stays readable. New mail to that address is handled by the catch-all if it is on, and refused if it is not. The address is also taken off your key's published entries.
Does the catch-all count against my ten?
No. The ten are addresses you created; the catch-all is a single switch covering everything else.
Can two of my addresses have different names shown to recipients?
Yes. Each address carries its own, so one can be your name and another a company name.
Will people see my Private.Ki address when I write from my domain?
No. Mail sent from an address on your domain is from that address, and the technical headers name your domain too. Your main address is not disclosed by sending.