Skip to content

anonaddy

Privacy & Ad-blocking

Self‑hosted anonymous email forwarding service for protecting personal email addresses

PHP Latest v1.6.1 · 24d ago Security brief →

Features

  • Create disposable or permanent email aliases that forward to a real inbox
  • Encrypt forwarded emails with user‑provided GPG/OpenPGP keys
  • Support custom domains and shared domain aliases
  • Zero‑knowledge storage – the service does not retain email content
  • Rate limiting, spam prevention, and bandwidth usage tracking

Recent releases

View all 9 releases →
v1.6.1 Bugfix

Fixed missing `quarantined` cast to bool preventing mobile app crashes.

Full changelog
  • Fixed missing quarantined cast to bool causing mobile app crash - https://github.com/anonaddy/addy-android/issues/61
v1.6.0 Breaking risk
⚠ Upgrade required
  • Edit `/etc/rspamd/local.d/milter_headers.conf` and update the `add_should_quarantine_header` routine as shown.
  • Create or edit `/etc/rspamd/local.d/actions.conf` and set `reject = 500;` to disable hard reject.
  • Run `sudo service rspamd reload` after making these configuration changes.
Breaking changes
  • Recipients are no longer detached from aliases when the alias is deleted.
Notable features
  • Added inbound quarantined handling for previously rejected spam emails
  • Added failed delivery notification preferences to enable/disable notifications
  • Added modal confirmation before downloading a quarantined email
Full changelog
  • Added inbound quarantined to failed deliveries for emails that were previously rejected as spam
  • Added failed delivery notification preferences, allowing you to turn off failed delivery notifications
  • Added modal confirmation for downloading a quarantined email
  • Improved some failed delivery error codes to be more clear
  • Added quarantine action to rules
  • Recipients are no longer detached from aliases when the alias is deleted

Breaking Changes

In order to quarantine spam emails detected by Rspamd instead of rejecting them we need to make some changes to Rspamd config.

Edit /etc/rspamd/local.d/milter_headers.conf and update the add_should_quarantine_header routine (this should already be present):

  add_should_quarantine_header = <<EOD
return function(task, common_meta)
  local metric = task:get_metric_score('default')
  local score = metric and metric[1] or 0
  local reject_threshold = 15.0
  local should_quarantine = false
  local quarantine_reason = nil

  if score >= reject_threshold then
    should_quarantine = true
    quarantine_reason = quarantine_reason or '5.7.1 Spam message rejected'
  end

  if should_quarantine then
    return nil,
      {
        ['X-AnonAddy-Should-Quarantine'] = 'Yes',
        ['X-AnonAddy-Quarantine-Reason'] = quarantine_reason or '5.7.1 Spam message rejected'
      },
      {
        ['X-AnonAddy-Should-Quarantine'] = 0,
        ['X-AnonAddy-Quarantine-Reason'] = 0
      },
      {}
  end

  return nil,
    {},
    {
      ['X-AnonAddy-Should-Quarantine'] = 0,
      ['X-AnonAddy-Quarantine-Reason'] = 0
    },
    {}
end
EOD;
}

Then edit (or create) /etc/rspamd/local.d/actions.conf and set a high score threshold for the rejection action. This is to prevent Rspamd rejecting messages outright so that we can instead quarantine them:

reject = 500;      # disable hard reject in order to quarantine

Then run sudo service rspamd reload to reflect these changes.

v1.5.1 New feature
Notable features
  • Pagination added to Blocklist entries
  • Filters and sorting capabilities for Blocklist
Full changelog
  • Upgraded to Laravel 13
  • Added pagination to Blocklist entries
  • Added filters and sorting to blocklist
  • Improved parsing of mail log, 4.X.X deferrals are no longer stored, fixed an issue with IPv6 addresses
  • Upgraded Webauthn package

Full Changelog: https://github.com/anonaddy/anonaddy/compare/v1.5.0...v1.5.1

v1.5.0 Breaking risk
Breaking changes
  • Web app system user requires read permission on mail.log (use setfacl to configure)
  • Logrotate postrotate hook must be updated to reapply mail.log permissions on rotation
Notable features
  • Inbound rejections visible in failed deliveries when rejected by addy.io mail servers
  • Email notification when alias is deactivated or deleted via one-click unsubscribe
  • Inbound/outbound filter and pagination for failed deliveries

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
4,673
Forks
262
Languages
PHP Vue Blade

Alternative to

similar service

Beta — feedback welcome: [email protected]