2026 NDSS Email Alias Study: How to Verify Address Identity?

The official NDSS record lists the paper “One Email, Many Faces: A Deep Dive into Identity Confusion in Email Aliases” as part of the 2026 research program. Its subject is identity confusion around email aliases—not proof that every provider or website treats aliases the same way. The practical rule is to verify an address against the provider’s current rules, the exact address saved on the website account, and a real message record. Don’t infer identity from a similar-looking address alone. (NDSS paper record; official proceedings)

Suitable for: You use aliases for ongoing subscriptions, website accounts, or client and project mail, and need reliable records.

Not suitable as a substitute: You need to decide whether a particular message is safe based only on its displayed address. Address similarity cannot authenticate a sender.

Who should read this: People maintaining long-term website accounts can check that each account is tied to the correct address. Freelancers can make separate client and project identities easier to distinguish. Anyone responsible for account recovery can build a repeatable address-checking routine.

Last updated October 25, 2026. Checked against the official NDSS paper record, the conference proceedings, and the paper text. Platform-specific rules should be rechecked in the relevant provider’s current documentation.

What the NDSS 2026 email alias study means for your records

The paper’s title and official record identify its focus as identity confusion involving email aliases. That is a reason to check how addresses are interpreted; it is not a basis for claiming that every email provider, website, or user will encounter the same behavior. The paper’s findings should be read within the research objects and test scope it describes. The available official sources are the NDSS paper record, the paper text, and the NDSS 2026 proceedings.

For everyday email address management, the useful takeaway is operational: reconcile three records before you conclude that two addresses belong to the same identity.

• Provider rule: What does your email provider say about the address format and where messages go?
• Website record: What complete address is actually saved in the account settings?
• Message record: What complete recipient address appears in the message you received?

These records answer different questions. A provider’s rule describes how it handles an address. A website’s account settings show what that site has stored. A received message gives evidence about that delivery, but does not by itself establish who sent it or whether the sender is legitimate.

What does the study change for an ordinary user? It makes careful record-keeping more important than visual guesswork. You do not need to change every address you use. Start by recording the exact address for each account, and check provider and website rules when the relationship between addresses matters.

Before using an alias, identify its type

“Alias” can describe different arrangements. Treat the following as separate options until your provider’s documentation confirms how each one works.

• Plus-addressing or subaddressing: An address is formed using an added tag, often after a plus sign. Whether a provider accepts that format, delivers it to an existing mailbox, or exposes it to a website depends on that provider’s rules.
• Explicitly created alias: You create an additional address through your email service. Its management options and relationship to your main mailbox depend on the service.
• Forwarding address: Mail sent to one address is redirected to another inbox. Forwarding describes a delivery path; it does not automatically tell you how a website treats the source address as an account identifier.
• Separate mailbox: A distinct inbox may have its own credentials, settings, and recovery process. That is different from assuming an additional address is only another route to one mailbox.

Do not rely on a familiar address pattern as a universal rule. For example, some providers document that punctuation in an address is handled in a particular way, while other providers or websites may not follow that behavior. Check the current documentation for the service you use. If you use a provider with a specific dot-handling rule, consult its official explanation of how dots affect addresses rather than applying that rule to other providers.

Record the provider’s exact terms, including the address type, where messages arrive, and whether you can manage or disable that address independently. If the documentation does not answer a question, leave the behavior marked “unverified.” Do not turn an assumption into a permanent account rule.

At signup, save the address the website actually accepts

Websites may use the submitted email address as an account identifier. Two addresses that deliver to the same inbox may still be stored or treated as different account details. Conversely, a website may normalize some address formats. Do not guess which case applies.

For every account you intend to keep, save the complete address exactly as it appears in the account’s contact or sign-in settings. Store the provider or service behind it, the account’s purpose, and whether the address is used for sign-in, notices, or recovery. Keep the entry in a password manager or another private record you already maintain; avoid putting sensitive account details in a shared project note.

How can you confirm whether two similar addresses are the same alias? Compare the complete addresses, then check the provider’s documentation and the account’s saved contact details. If the website provides an address-change history or a confirmation message, use that evidence too. Do not decide from matching names, punctuation, or inbox destinations alone.

When updating an account, use the website’s own account settings and help information. Confirm the new address through the site’s stated process, then check that the updated address appears in the account record. If you cannot confirm the change, keep the previous working contact method until you have resolved the account’s status. Avoid creating a second account just to test how the site handles an address; that can create duplicate records or conflict with the site’s rules.

Address identity checklist

• [ ] I checked the current provider documentation for this address format.
• [ ] I saved the complete address as the website displays it.
• [ ] I recorded which provider or alias service handles it.
• [ ] I noted whether it is used for sign-in, notifications, recovery, or more than one purpose.
• [ ] I confirmed address changes through the website’s account settings.
• [ ] I did not infer that two addresses are equivalent just because they look alike.

When a message arrives, verify the recipient and sender separately

A message can reveal which address received it, but that does not make the sender trustworthy. Check the full recipient address shown in the message details, not only the name or abbreviated address in the inbox list. Compare it with your account record and the notification you expected.

Next, check the sender address and the context of the message. If it asks you to sign in, change payment details, or provide credentials, do not use a link or phone number supplied in an unexpected message. Instead, open the service through a route you already trust and check the account there. The CISA phishing and spoofing guidance recommends caution with suspicious messages; an address that resembles one you recognize is not, by itself, proof of authenticity.

A message arrived at an address that looks like mine. How do I check whether it was intended for the right account? Compare its full recipient address with the exact address saved in that account’s settings. Then check whether the message matches an expected notification and verify any requested action through the service’s official account page. If the address does not match your record, or the sender’s request is unexpected, do not provide credentials in response.

Use this simple sequence when a message raises a question:

1. Open the message details and inspect the complete recipient address.
2. Compare it with your account record, character by character.
3. Check the sender address and whether the notification was expected.
4. Verify account changes through the service’s usual official channel.
5. Update your record only after you have confirmed what happened.

Do not treat forwarding as sender verification. A message reaching your main inbox through an alias or forwarding rule tells you about delivery, not whether the displayed sender is genuine. Keep those checks separate.

Maintain recovery paths before changing or disabling an address

A long-term email alias is useful only if you can still receive the messages you need and maintain access to the related account. Before changing an address, turning off an alias, or editing a forwarding rule, identify the accounts that depend on it. Check for security alerts, billing notices, project correspondence, and account-recovery messages.

Then test your planned change on a non-critical account, if the site permits it. Confirm the new address in the site settings and verify delivery before retiring the old route. If the alias cannot be restored after removal, treat the change as a one-way action until the provider says otherwise. Keep an accessible recovery method that is not dependent on the address you are about to disable.

What if a website treats an alias as a separate address? Keep a separate account entry for each address the site has accepted. Record whether the site has created a separate account or merely saved a different contact address. When in doubt, check the account settings or ask the site through its published support channel. Do not merge records based on the fact that messages arrive in one inbox.

Use an email address you can access over the long term for accounts where losing access would have serious consequences. That includes banking, payment, government, and other important services. A short-term inbox or an address you may soon disable is not an adequate replacement for a stable recovery contact.

Long-term maintenance checklist

• [ ] List accounts that use the address before changing or disabling it.
• [ ] Check which accounts rely on it for sign-in or recovery.
• [ ] Confirm the replacement address in each website’s account settings.
• [ ] Test expected delivery before removing the old route.
• [ ] Keep important accounts on an email address you can access long term.
• [ ] Review the record whenever you change providers, forwarding, or alias settings.

Choose an address setup that matches the account

Use this comparison to decide what to verify, not to assume that one option behaves identically across services.

No setup is universally best. Choose a provider-managed alias when you need a lasting address that you can maintain and map to an account. Choose a subaddress only when the provider’s rules and the site’s behavior are clear. Use your durable main contact for accounts that must remain recoverable. A temporary inbox is for limited, non-critical use, not for accounts that may need a password reset months later.

Put the checks into practice without creating more account risk

Test your process with one non-critical account. Keep the test within the website’s rules. The goal is to confirm your own records and delivery path, not to discover ways around a site’s registration limits.

First, read the provider rule. Find the current explanation of the address format you plan to use. Note the address type and any stated limits on routing or management.

Next, record the intended address. Save the full address, provider, purpose, and expected destination in your private account record before submitting it.

Then, register through the normal flow. Enter the address exactly as intended. If the site rejects it or presents a different stored address, pause and consult that site’s help information rather than repeatedly trying variations.

After that, verify the account record and delivery. Check the contact details shown in the website account. Compare the recipient address on the confirmation message with your saved entry. A successful delivery does not prove that the site will treat other similar addresses as equivalent.

Finally, add a maintenance note. Record what you confirmed, what remains unknown, and what to check before changing the route. If you later change providers or forwarding, repeat the relevant checks instead of relying on memory.

This process keeps research, provider rules, and website behavior distinct. The NDSS paper gives you a reason to examine identity handling; the provider documents explain that provider’s rules; the website’s own account record shows what it has accepted. None of those sources should be treated as a substitute for the others.

For a single non-critical signup or one expected message, a temporary inbox can be a reasonable alternative if the website permits it and you do not need future access. EmailPut may fit that limited use; check its live service information before relying on any particular address option. For a long-term account, save the exact address, confirm that you can keep receiving mail, and retain a recovery path you control. Start by checking one existing account today, then use the same record-keeping routine whenever you add or change an alias.