Changelog for October 30th, 2026

New

• You can forget every deleted alias at once from the aliases page. Filter to Deleted only, then choose Forget all deleted.
• Custom aliases on a username or a domain you own can append random characters. Set this in General settings.
• A custom domain can limit replies and sends on new aliases to recipients attached to that alias. Forwards still use the domain's default recipient.

Improvements

• Forwards to iCloud, me.com, and mac.com no longer put the alias in the visible To address. Having the same From: and To: header was causing those inboxes to treat the mail as spam.
• Spam-report emails now say the alias was deactivated, and they link to What to do when forwarded email is marked as spam.
• A custom domain stays verified until its MX checks fail three times in a row. A temporary DNS error does not count as a failure.
• Turning off your last authenticator app or security key now warns you which sign-in method you must use next.

Fixes

• A private PGP key can no longer be disguised and saved as a recipient public key
• The API logout response was invalid when the API key was missing
• Forwarding no longer fails when a message has malformed headers
• Requesting a password reset no longer sends a second email while the first link is still valid