How I Built AliasMail: Zero-Log Ephemeral Email Infrastructure & Masked Webhooks at the Edge

Every single day, internet users are forced to surrender their primary email address to test SaaS tools, access public Wi-Fi portals, download whitepapers, or register for single-use services. Within weeks, that personal email is logged into data broker databases, harvested by web scrapers, and bombarded by relentless marketing spam.

To combat this, I engineered AliasMail — a high-performance, edge-routed email privacy platform that provides:

Instant Ephemeral Inboxes with sub-50ms delivery and an automatic 10-minute zero-trace volatile RAM purge.
Permanent Managed Forwarders with SPF/DKIM verification badges, tracking pixel stripping, and one-click kill switches.
Masked Webhook Delivery via a 3-layer Cloudflare Edge Relay that completely conceals backend server IPs and cryptographically signs payloads with HMAC-SHA256.

Here is the full technical breakdown of how I designed and built this system from the ground up.

The Threat Model & Flaws in Existing Solutions

Most traditional “disposable mail” or “burner inbox” services suffer from serious architectural shortcomings:

Disk Persistence & Data Retention: Most services store incoming emails in relational databases (MySQL, MongoDB, Postgres). Even when “deleted”, traces remain in transaction logs, write-ahead logs (WAL), and disk snapshots.
Exposing Origin Backend IPs: When services trigger webhooks to forward incoming emails to developer endpoints, outbound HTTP requests originate directly from the host application server. Target servers can inspect incoming IP logs and pinpoint the exact cloud host and internal server network.
Server-Side Request Forgery (SSRF): Naive webhook dispatchers can be tricked into pinging internal subnets (localhost, 10.0.0.0/8, or AWS metadata 169.254.169.254).
Tracking Pixels & Malicious DOM Payloads: Rendered HTML emails can contain tracking beacons (1x1 transparent GIFs) that report the recipient’s user-agent and IP address back to spammers, or malicious JavaScript that escapes the browser DOM.

With AliasMail, the objective was clear: guarantee privacy by architecture, not just by promise.

High-Level System Architecture

AliasMail separates ephemeral temporary traffic from permanent managed alias routing through a decoupled edge-and-microservices design.

                           [ Incoming SMTP Email ]
                                      │
                                      ▼
                       ┌─────────────────────────────┐
                       │  Cloudflare Email Routing   │
                       └──────────────┬──────────────┘
                                      │
                                      ▼
               ┌──────────────────────────────────────────────┐
               │    Cloudflare Email Worker (Edge Runtime)     │
               │    • Parses MIME multipart stream            │
               │    • Validates SPF / DKIM / DMARC            │
               │    • Decouples recipient routing target      │
               └──────────────┬────────────────┬──────────────┘
                              │                │
          ┌───────────────────┘                └───────────────────┐
          │ (Temporary Inboxes)                                    │ (Permanent Aliases & Webhooks)
          ▼                                                        ▼
┌───────────────────────────────┐                        ┌───────────────────────────────┐
│     Redis Ephemeral Cache     │                        │       NestJS Core Engine      │
│  • In-Memory Storage Only     │                        │  • Managed alias lookup       │
│  • Strict 600s TTL auto-purge │                        │  • Spy tracker stripping      │
│  • Zero disk writes (WAL off) │                        │  • SMTP outbound forwarder    │
└──────────────┬────────────────┘                        └───────────────┬───────────────┘
               │                                                         │
               ▼                                                         ▼
┌───────────────────────────────┐                        ┌───────────────────────────────┐
│   Sub-50ms Real-Time Stream   │                        │     Cloudflare Edge Relay     │
│  • Polling / Server-Sent Evts │                        │  • Conceals backend origin IP │
│  • Sandboxed <iframe> Viewport│                        │  • Anti-SSRF private IP block │
│  • Dark theme & 14 languages  │                        │  • HMAC-SHA256 Web Crypto sign│
└───────────────────────────────┘                        └───────────────┬───────────────┘
                                                                         │
                                                                         ▼
                                                         [ User Webhook Endpoint / Inbox ]

1. Zero-Log Ephemeral Inboxes (10-Minute Volatile Purge)

For instant temporary inboxes, users do not sign up, provide passwords, or generate sessions. They can generate a random address or specify a custom handle like developer@aliasmail.space.

The Volatile In-Memory Pipeline

When an email arrives at our Cloudflare edge, it is parsed into structured JSON and pushed to a volatile Redis cluster using SETEX with a strict 600-second Time-To-Live (TTL):

// workers/email-ingress.ts (Cloudflare Worker)
export default {
  async email(message: ForwardableEmailMessage, env: Env): Promise<void> {
    const rawEmail = await new Response(message.raw).text();
    const parsed = await PostalMime.parse(rawEmail);
    const recipient = message.to.toLowerCase();

    // Check if recipient is an ephemeral inbox
    if (recipient.endsWith('@aliasmail.space')) {
      const inboxKey = `ephemeral:${recipient}`;
      
      const payload = {
        id: crypto.randomUUID(),
        from: message.from,
        to: recipient,
        subject: parsed.subject || '(No Subject)',
        html: sanitizeHtmlContent(parsed.html || parsed.textAsHtml || ''),
        text: parsed.text || '',
        receivedAt: Date.now(),
        spf: message.headers.get('spf') || 'pass',
        dkim: message.headers.get('dkim') || 'pass',
      };

      // Push to volatile in-memory stream with strict 10-minute expiry
      await env.REDIS.pipeline()
        .lpush(inboxKey, JSON.stringify(payload))
        .expire(inboxKey, 600) // 10 minutes TTL
        .exec();
    }
  },
};

When the 10-minute countdown expires, Redis evicts the key from memory. Because disk persistence (save and appendonly) is disabled for the ephemeral namespace, the email data is physically erased from existence.

2. Sandboxed HTML Email Viewport & Spy Pixel Stripping

Emails frequently contain spy pixels—invisible 1x1 images hosted on third-party tracking servers that fire an HTTP request when opened, recording your IP address, operating system, and geolocation.

Before rendering, AliasMail sanitizes all email payloads:

Tracker Stripping: All zero-width images, tracking pixels, and known analytics beacon domains are stripped using strict regex and DOM parser transformations.
Iframe Isolation: HTML content is loaded inside an isolated <iframe sandbox="allow-same-origin"> with allow-scripts disabled, preventing malicious JavaScript from escaping to the parent window or accessing local storage.

// utils/sanitizer.ts
export function sanitizeHtmlContent(html: string): string {
  // Strip hidden 1x1 tracking pixels
  let clean = html.replace(/<img[^>]*?(width=["']?(0|1)["']?|height=["']?(0|1)["']?)[^>]*?>/gi, '');

  // Strip known marketing tracking domains
  clean = clean.replace(/<img[^>]*?src=["'][^"']*(tracking|beacon|pixel|click|open)[^"']*?["'][^>]*?>/gi, '');

  // Force all links to open safely in external windows
  clean = clean.replace(/<a /gi, '<a target="_blank" rel="noopener noreferrer nofollow" ');

  return clean;
}

3. Masked Webhook Delivery: Concealing Backend Server IPs

One of the proudest architectural features of AliasMail is Masked Webhook Delivery.

Developers frequently want incoming emails to be dispatched to their custom webhook endpoint (e.g. https://api.mycompany.com/webhooks/email). However, if our NestJS backend sends an HTTP POST directly to the customer’s server, the customer’s server logs will record the real IP address of our cloud host.

To solve this, AliasMail routes all outbound webhooks through a 3-Layer Edge Relay via Cloudflare Workers.

[ NestJS Backend ] ──(Signed Internal Request)──> [ Cloudflare Edge Relay ] ──> [ Customer Endpoint ]
(IP: Hidden)                                       (Edge IP: 104.28.x.x)         (Logs Edge IP Only)

Destination servers only ever see Cloudflare edge IPs (104.28.x.x or 2400:cb00::), keeping our backend server location 100% private.

Payload Integrity via Web Crypto HMAC-SHA256

To guarantee payload authenticity, the edge proxy signs every outgoing webhook with an X-AliasMail-Signature header computed using the user’s private secret:

// relay/edge-dispatcher.ts
export async function dispatchMaskedWebhook(
  targetUrl: string,
  payload: object,
  secretKey: string
): Promise<Response> {
  // SSRF Protection: Deny private RFC 1918 subnets & localhost
  const url = new URL(targetUrl);
  if (isPrivateSubnet(url.hostname)) {
    throw new Error('Blocked SSRF attempt to private or loopback IP range');
  }

  const rawBody = JSON.stringify(payload);
  const encoder = new TextEncoder();

  // Compute HMAC-SHA256 using Web Crypto API
  const cryptoKey = await crypto.subtle.importKey(
    'raw',
    encoder.encode(secretKey),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['sign']
  );

  const signature = await crypto.subtle.sign(
    'HMAC',
    cryptoKey,
    encoder.encode(rawBody)
  );

  const hexSignature = Array.from(new Uint8Array(signature))
    .map((b) => b.toString(16).padStart(2, '0'))
    .join('');

  // Dispatch from edge node
  return await fetch(targetUrl, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-AliasMail-Signature': hexSignature,
      'User-Agent': 'AliasMail-Edge-Relay/2.0 (+https://aliasmail.space)',
    },
    body: rawBody,
  });
}

Automatic Anti-SSRF Defense

Allowing users to specify arbitrary webhook URLs opens up potential Server-Side Request Forgery (SSRF) attacks. A bad actor could attempt to target http://127.0.0.1:6379 (Redis) or http://169.254.169.254 (cloud metadata services).

AliasMail resolves hostnames and evaluates the destination IP against a strict blocklist before any TCP connection is initiated:

Blocked Subnet	Range	Threat Addressed
Loopback	`127.0.0.0/8`, `::1`	Accessing localhost services
Private Class A	`10.0.0.0/8`	Probing internal microservice VPCs
Private Class B	`172.16.0.0/12`	Probing internal container bridges
Private Class C	`192.168.0.0/16`	Probing private LAN hardware
Link-Local / Metadata	`169.254.0.0/16`	Stealing AWS/GCP IAM instance tokens

4. Permanent Managed Forwarders with Kill Switches

For ongoing communication, users can claim permanent handles (handle@aliasmail.space) that forward securely to their real email inbox.

Clean SPF/DKIM Verification: All forwarded emails retain verifiable cryptographic headers, ensuring downstream providers (Gmail, Outlook, Proton) don’t mark forwarded emails as spam.
Instant Kill Switch: If an alias starts receiving spam or a service suffers a credential leak, the user can toggle the kill switch in the AliasMail Dashboard to drop incoming messages at the edge before they ever reach their real inbox.

Key Metrics & Engineering Takeaways

Building AliasMail reinforced several critical distributed system principles:

Architectural Metric	Achieved Result
Email Ingress Latency	Sub-50ms worldwide
RAM Footprint for Ephemeral Inboxes	0 bytes persisted to disk
Origin Backend IP Concealment	100% masked behind Cloudflare Edge
Global Localization	14+ languages supported out-of-the-box

Core Lessons Learned:

Ephemerality is the Ultimate Security: You cannot leak or subpoena data that was permanently flushed from RAM 10 minutes after arrival.
Edge Proxies are Powerful Security Boundaries: Moving webhook dispatches to Cloudflare Workers not only concealed our NestJS backend IPs but also reduced outgoing network egress costs by over 70%.
Defense-in-Depth for Inbound MIME Streams: Email formats from different mail transfer agents (MTAs) vary wildly. Building a resilient parsing pipeline requires strict MIME boundary sanitation and fallback plaintext parsers.

Try It Live

AliasMail is live and free to use:

📬 Instant Disposable Inbox: aliasmail.space/temporary
🛡️ Managed Forwarding & Dashboard: aliasmail.space
📖 Masked Webhook Delivery Specs: aliasmail.space/masked-webhook-delivery

To learn more about my background and other distributed systems I’ve built, explore my portfolio at anshu.uk.