Fastmail Masked Email on a Custom Domain vs Catch-All

Yes, Fastmail Masked Email can use your own domain. An account admin picks one custom domain at Settings → Users & Sharing → Team settings, and new Masked Email addresses are then generated on it, such as dog.food3495@example.com. The domain has to be set up in Fastmail first, which needs a plan above Basic. The two other ways to get a separate address per site on that domain are a catch-all (wildcard) alias and subdomain addressing, where you make up each address yourself.

Fastmail details below were checked against its help pages on September 25, 2026. Whichever you choose, CatchNone can read your Fastmail inbox on iPhone, iPad, and Mac and badge each message with the address it reached, so a leaked or sold address shows up.

Three ways to get per-site addresses at Fastmail

• Masked Email. Fastmail generates a random address for each site, and you add a description. You can create them in Fastmail, 1Password, or Bitwarden.
• Catch-all alias. One alias, *@example.com, accepts mail to any address at your domain, so you can type shop@example.com into a signup form without creating it first.
• Subdomain addressing. You make up addresses such as shop@you.example.com, built on an address you already have, you@example.com. It’s on by default.

Nothing in Fastmail’s help rules out mixing all three on one domain, though it doesn’t document every interaction (more on that below). As of September 2026, custom domains need at least one account admin on a plan other than Basic: Individual, Duo, Family, or a Business Standard or Professional plan. If you’re still choosing a host, see our comparison of email providers for a custom domain.

How to set up Fastmail Masked Email on a custom domain

On the web:

1. Go to Settings → Domains, click Add or buy domain → Use a domain you already own, and finish the DNS setup (Fastmail’s custom domain guide). Only account admins can manage domains.
2. Go to Settings → Users & Sharing → Team settings and choose that domain for Masked Email.
3. Go to Settings → Masked Email and click New Masked Email address.
4. Add a description, such as the site’s name, and click Save.

The setting covers the whole account, so you can’t pick a domain per address (Fastmail’s developer docs). Fastmail doesn’t document what happens to existing addresses when you change it.

Its Masked Email FAQ calls the choice a trade-off: addresses on your own domain are easier to link to you than ones on the shared fastmail.com domain, but they “remain portable”. In practice, if you ever leave Fastmail, a catch-all at your new host keeps receiving mail sent to every Masked Email address on your domain. Addresses on fastmail.com stay behind.

Per Fastmail’s Masked Email help, mail to these addresses arrives in your Inbox by default, shows the description with a mask icon, and carries a Fastmail-MaskedEmail header you can match in a rule. Replies go out from the Masked Email address by default; to start a new message from one, click Show all in the From menu.

From 1Password or Bitwarden

• 1Password: go to Settings → Masked Email → Connect to 1Password and approve the access. On a signup page, select the email field and choose Create Masked Email, then Fill Email. 1Password’s help says this needs 1Password in the browser: Mac, Windows, Linux, or Safari on iPhone and iPad.
• Bitwarden: create a Fastmail API token with only the Masked Email scope (steps below). In Bitwarden’s Generator, choose Username, set the type to Forwarded email alias and the service to Fastmail, and paste the token into the API key field (Fastmail’s help calls it API Access Token). As of September 2026, Bitwarden’s help lists Fastmail for most of its apps but not the mobile app, so on a phone use Fastmail’s app or 1Password in Safari.

Masked Email and alias limits

As of September 2026, a Fastmail account can have up to 600 aliases plus 15 for every user, per its Account limits page. A catch-all counts as one alias, and each address you block under it with the steps further down becomes another.

Masked Email has its own caps, on each user’s total and on how many can be created in a period, but Fastmail publishes neither number. If creating one fails, the Masked Email help says to try again in 24 hours or contact support. Fastmail doesn’t say whether Masked Email addresses also count as aliases.

Catch-all (wildcard) aliases

Fastmail’s catch-all alias sends “all mail to any address at a custom domain” into your account. If the idea is new, read what a catch-all address is and why it draws spam. To create one (Fastmail’s catch-all help):

1. Go to Settings → My email addresses and click Add address.
2. Click Create an alias.
3. Enter * and choose your domain from the menu, so it reads *@example.com. Click Create alias.
4. Set the delivery and compose options, then click Save.

How it behaves:

• A specific alias wins. Mail to an address you’ve created separately goes to that alias, not the catch-all.
• Address actions carry over. An action on the catch-all, such as moving mail to a folder, applies to every message it catches, but not to specific aliases.
• New aliases can take up to 15 minutes to work, and mail sent to them in that time may bounce.
• You can send as any address. Pick the catch-all as the From address and type the part before the @.

Subdomain addressing: anything@you.example.com

Subdomain addressing is plus addressing written as a subdomain: the tag moves in front of the @, and your alias becomes part of the domain. If you@example.com is one of your addresses, mail to shop@you.example.com is delivered as you+shop@example.com. Fastmail offers it because some sites wrongly reject addresses with a +, a problem our guide to plus addressing and where it breaks covers.

It works for any alias without setup, as long as subdomain mail reaches Fastmail:

• Nameservers at Fastmail: nothing to do.
• MX records only: add MX records for *.example.com pointing to in1-smtp.messagingengine.com (priority 10) and in2-smtp.messagingengine.com (priority 20). Fastmail’s manual DNS page warns that “an A record hides the wildcard subdomain MX record”, so if you.example.com has its own A record, give it the same two MX records.

The rules, from Fastmail’s plus and subdomain help:

• The alias you turn into a subdomain (you in you@example.com) can’t contain a dot or an underscore.
• Only one level works: shop@you.example.com does, a@shop.you.example.com doesn’t.

Mail is also filed automatically: if the part before the @ matches a folder name, the message skips the Inbox and goes into that folder. Matching ignores case and treats hyphens, underscores, and spaces alike, so online-shop@you.example.com lands in “Online Shop”. A rule that files the message wins.

Each domain has three subdomain options at Settings → Domains → Edit next to the domain → Routing → Manage:

1. Deliver anything@alias.example.com as alias+anything@example.com. This is the default, and Fastmail recommends keeping it.
2. Ignore the subdomain and deliver to alias@example.com.
3. Reject all subdomain mail.

Masked Email vs catch-all vs subdomain addressing

As of September 2026, from the providers’ help pages.

CatchNone is receive-only by design: it reads and sorts the mail, and you reply from Fastmail. On your own domain, that mail also stays in your Fastmail Inbox; @catchnone.com addresses (Premium) keep it out of Fastmail entirely.

In every case the To line shows whatever the sender wrote, and Bcc’d mail may not show your address at all. Fastmail adds two headers that show where a message really went (delivery process page): X-Delivered-to, the address the sender used, and X-Resolved-to, the address it was finally delivered to after subdomain and alias rewriting.

How to shut off one address

A Masked Email address

Open Settings → Masked Email, find the address with Search Masked Email, and block or delete it. A blocked address sends new mail to Trash, so the sender gets no bounce and you can still read it there. A deleted address bounces new mail, and you can restore it at any time from Review deleted masked addresses. In 1Password, Block Incoming Emails blocks the address, but deleting it has to be done in Fastmail.

An address on the catch-all

A catch-all has no per-address switch, so you create the address as its own alias and disable it:

1. Go to Settings → My email addresses → Add address → Create an alias.
2. Enter the address you want to stop, click Create alias, then click Save on the next screen.
3. Go to Settings → Users & Sharing → Aliases and click that alias.
4. Click Show advanced preferences (Fastmail’s alias help calls it Show advanced delivery preferences), and in the Disable section select the box to reject all mail sent to this address.
5. Click Save.

Mail to it now bounces, and the rest of the domain keeps working. To avoid the bounce, leave Disable unchecked and give the alias the address action Delete to trash instead: its mail goes to your Trash folder, and your rules don’t run on it.

A subdomain address

Fastmail documents no switch for a single subdomain address. Two tools come close:

• A rule at Settings → Filters & Rules → Create rule (Fastmail’s rules help) can match the To/Cc/Bcc field and apply Delete to trash or Send to spam. Its Anywhere condition also searches X-Delivered-to, which catches Bcc’d copies, but it searches the message body too, so check the preview of matching messages before you save.
• Custom Sieve code with reject sends a real bounce. Use Edit custom Sieve code on the same screen (Fastmail’s Sieve help).

Fastmail documents both tools but not this exact use, so send a test message first. The third Routing option above rejects every subdomain address on the domain at once.

What happens if you remove the domain

• Masked Email: Fastmail says the addresses on that domain are deleted and mail to them bounces. It doesn’t say whether they come back if you add the domain again.
• Aliases and the catch-all: Fastmail won’t delete a domain until no aliases, users, or websites use it. After that, mail to the domain is rejected if its MX records still point to Fastmail.

Fastmail’s deletion steps don’t mention Masked Email, so don’t count on a warning. First note the addresses at Settings → Masked Email; their descriptions show which site uses which. If you’re giving the domain up, change your email address on those sites. If you’re moving it to another host, set up a catch-all there before you switch the MX records, and every address on the domain keeps receiving mail, Masked Email and made-up addresses alike.

Which one to use

• You want to see which address each message reached, on iPhone, iPad, and Mac: CatchNone, reading your catch-all (details below).
• You sign up in a browser with 1Password or Bitwarden: Masked Email. The address and password are created together.
• You’d rather your addresses didn’t point to your own domain: @catchnone.com addresses with CatchNone Premium, or Masked Email on fastmail.com, which many users share.
• You might leave Fastmail one day: anything on your own domain. Masked Email on fastmail.com can’t move with you.
• You make up addresses anywhere, including on paper or over the phone: the catch-all. Bitwarden’s Catch-all email type can also make random ones for you.
• You sort mail into folders: subdomain addressing files it for you.
• Accounts you’ll keep for years, such as your bank: a regular alias. Fastmail designs aliases for “permanent use” and Masked Email for logins.
• You want every leaked address to bounce cleanly: @catchnone.com addresses (switch one off), Masked Email (delete the address), or the catch-all (disable the alias).

You can also combine them: Masked Email for logins, a catch-all for everything else. Fastmail doesn’t document whether the catch-all picks up mail to a deleted Masked Email address on the same domain, so test before you count on the bounce.

Letting another app read your mail: API token or app password

If an app connects by asking you to approve access in Fastmail (OAuth), as 1Password does, use that: Fastmail shows what data will be shared before you allow it. Otherwise, a JMAP API token with only the scopes the app needs is the narrowest credential. An app password with mail access also lets the app send mail and move or delete messages. Neither tokens nor app passwords exist on Basic plans.

A JMAP API token

From Fastmail’s API token help:

1. Go to Settings → Privacy & Security, find Connected apps & API tokens, and click Manage API tokens.
2. Click New API token, and enter your password if Verify it’s you appears.
3. Name the token after the app.
4. Under Type, select JMAP (MCP is for AI tools).
5. Under Scopes, select only what the app needs, then click Generate API token. Copy it at once; Fastmail won’t show it again.

The JMAP scopes are Read-only access (view and download, no changes), Email (read, modify, and permanently delete mail), Email submission (send), Contacts and contact groups, and Masked Email. For an app that only reads mail, select Read-only access and Email, and nothing else. Bitwarden needs Masked Email alone. Apps reach Fastmail’s JMAP at https://api.fastmail.com/jmap/session with the token in an Authorization: Bearer header. To revoke one, open it and click Remove access.

A read-only token is enforced by Fastmail’s server. Over IMAP, read-only is only a choice the app makes (the EXAMINE and BODY.PEEK commands in RFC 9051), and the password still allows changes. Our explainer on what read-only access means in IMAP and JMAP goes further.

An app password and Fastmail’s IMAP settings

Create one at Settings → Privacy & Security → Connected apps & API tokens → Manage app passwords and access → New app password, then choose the access and click Generate password (Fastmail’s app password help). The default, Mail, Contacts & Calendars, gives IMAP, POP, and SMTP, plus contacts and calendars. Mail (IMAP/POP/SMTP) is narrower but still includes sending. Fastmail documents no read-only app password.

From Fastmail’s server names and ports page, as of September 2026:

To cut an app off, select the checkbox next to the password and click Disable (reversible) or Remove (permanent). Review access shows when it was last used, from which IP address, and roughly where.

Reading your Fastmail aliases in CatchNone

CatchNone gives every address on your Fastmail domain its own list, on iPhone, iPad, and Mac. It reads your Fastmail Inbox read-only from your device, over JMAP with an API token (Read-only access plus Email is enough) or IMAP with an app password, so the mail never passes through CatchNone’s servers. Each message shows under the address on your domain it reached, so a leaked or sold address shows up. Made-up addresses on your catch-all get a gray badge until you create an alias with the same address in the app. The Free plan includes up to 10 aliases on your own domain, and Lite and Premium have no limit. CatchNone is available for iPhone, iPad, and Mac.

CatchNone is receive-only and works alongside Fastmail rather than inside it, so it doesn’t create, block, or delete Masked Email addresses. Each check reads the newest 100 Inbox messages from the last 30 days, counted before it filters by domain, so a busy Inbox can push alias mail out. Mail that subdomain addressing or a rule files into a folder, or that Fastmail sends to Spam, doesn’t appear. Domains match exactly, so add you.example.com as its own domain for subdomain addresses. Bcc’d copies aren’t imported, because only To, Cc, and Bcc lines naming your domain count. Marking an alias as not in use is only a label; to stop the mail, block or disable the address in Fastmail as described above.

If you’d rather not run a domain at all, Premium adds @catchnone.com addresses, with no domain, DNS, or mailbox to set up. Switch one off and senders get a bounce.

FAQ

What’s the difference between Masked Email and a Fastmail alias?

Fastmail describes Masked Email addresses as random aliases it generates, “designed for logins” and usually one per site, with password-manager integration. An alias is an address you choose yourself, with its own sending name or signature, meant for “permanent use for your different identities online”; a catch-all is an alias that matches every address on the domain. In practice, you block a Masked Email address (mail goes to Trash) or delete it (mail bounces), and it falls under Masked Email’s own unpublished cap. You switch an alias off with Disable, and it counts toward the limit of 600 aliases plus 15 per user.

Can I choose my own Masked Email address?

Not in Fastmail’s documented steps, which generate the address for you. Fastmail’s API lets an app request a prefix of up to 64 characters (a to z, 0 to 9, and underscores), and some third-party apps advertise custom prefixes. If you want to choose the whole address, use an alias or the catch-all.

Which username goes with a Fastmail app password?

The address you signed up with, including the domain, such as you@example.com. An alias or a Masked Email address won’t work. If an app rejects the @, Fastmail also accepts you#example.com, you/example.com, or you=example.com.

Fastmail Masked Email or CatchNone?

Masked Email lives inside your Fastmail account and is built for logins, with password-manager integration. CatchNone is an app for iPhone, iPad, and Mac that gives every signup its own address and badges each message with the alias it reached. It works alongside Fastmail, reading your catch-all over JMAP or IMAP, or, with Premium, gives you @catchnone.com addresses with no domain to set up. CatchNone is receive-only, so you reply from Fastmail. The email alias services comparison covers other options.