Every time you sign up for a service, you hand over your email address — and it rarely stays private. Breach databases, spam lists, data brokers — your inbox becomes a permanent tracking identifier that follows you everywhere.
The usual solutions all have problems: temporary email services expire, shared alias systems have central servers, and catch-all domains can’t truly “delete” an alias.
CloakMail takes a different approach. It’s a browser extension that generates a unique email alias per site, backed by a real Cloudflare Email Routing rule on your own domain. No servers, no subscriptions, no telemetry. When you delete an alias, mail bounces immediately — because the rule is gone from Cloudflare’s MTA.
Here’s how the whole stack fits together:
Free Domain (Stackryze) → DNS & Routing (Cloudflare) → Alias Engine (CloakMail) → Your Inbox
And the best part — everything in this guide is free.
What You’ll Need
- A free domain from domain.stackryze.com (or your own domain)
- A free Cloudflare account
- Chrome, Brave, or Edge browser
- Node.js ≥ 18 — only if building from source (optional)
Total setup time: about 20 minutes.
Step 1 — Get a Free Domain from Stackryze
You need a domain to create email aliases. Instead of paying for one, grab a free subdomain from domain.stackryze.com.
- Visit domain.stackryze.com
- Browse available options and pick a name you like
- Register it — the process takes about two minutes
You’ll end up with something like yourname.stackryze.com. Keep this handy — you’ll point it to Cloudflare next.
Already own a domain? Skip this step entirely and use your existing domain.
Tip: When choosing a name, keep it short and neutral. You’ll be generating aliases like
amazon.x91k@mail.yourdomain.com, so cleaner is better.
Step 2 — Configure Your Domain in Cloudflare
Cloudflare handles your DNS and powers CloakMail’s email routing. The free plan is more than enough.
2.1 — Create a Cloudflare Account
Head to cloudflare.com and sign up for a free account.
2.2 — Add Your Domain
From the Cloudflare dashboard, click Add a Site and enter your domain. Select the Free plan.
Cloudflare will scan your DNS records and then give you two nameservers:
ns1.cloudflare.com
ns2.cloudflare.com
Go back to Stackryze and update your domain’s nameservers to these two values. This delegates your DNS to Cloudflare.
Note: Propagation usually takes 5–30 minutes, but can occasionally take up to 24 hours.
2.3 — Enable Email Routing
Once your domain is active in Cloudflare:
- Open your domain in the dashboard
- Click Email → Email Routing in the left sidebar
- Click Enable Email Routing
- Accept all the prompted DNS record additions (MX and TXT records)
2.4 — Verify Your Destination Email
Under Email Routing → Destination addresses, click Add destination address and enter the real inbox you want aliases to forward to — for example, you@gmail.com.
Cloudflare will send a verification email. Click the link in it. Without this step, no routing rules will work.
Important: Do not enable catch-all on your alias subdomain. CloakMail creates dedicated per-alias rules — deleted aliases should bounce at Cloudflare’s MTA, not silently forward via catch-all.
2.5 — Create a Scoped API Token
CloakMail needs a Cloudflare API token to create and manage routing rules. Go to My Profile → API Tokens → Create Token → Custom token and configure it with these exact permissions:
| Resource | Permission |
|---|---|
| Zone | Read |
| Zone Settings | Read |
| Email Routing Rules | Read |
| Email Routing Rules | Edit |
Set the zone resource to your specific domain — don’t leave it as “All zones”.
Copy the token immediately. You only see it once.
Why not the Global API Key? Never use it for this. A narrowly scoped token limits blast radius — if it ever leaks, the damage is limited to email routing rules only.
2.6 — Find Your Zone ID
Open your domain in Cloudflare. On the Overview page, look at the right-hand sidebar. Copy the Zone ID — a long hex string that looks like:
b6a93b8d2a1f45c9e72d4b8f9c3a1234
You’ll need this in the CloakMail settings.
Step 3 — Install CloakMail
CloakMail is open source and available on GitHub. You have two ways to install it — pick whichever suits you.
Option A — Download the Pre-built ZIP (Easiest)
No Node.js required. Just grab the latest release directly from GitHub:
- Go to the Releases page
- Under the latest release, download
chrome-mv3-prod.zip - Unzip it anywhere on your computer
Then load it in your browser:
- Open
chrome://extensions(orbrave://extensions/edge://extensions) - Enable Developer mode (toggle in the top-right corner)
- Click Load unpacked
- Select the unzipped folder
- Pin CloakMail to your toolbar
Option B — Build from Source
If you prefer to build it yourself (requires Node.js ≥ 18):
git clone https://github.com/MauryaAnkit/Cloakmail.git
cd Cloakmail
npm install
npm run build
The built extension lands in build/chrome-mv3-prod/. Then follow the same browser loading steps from Option A (load that folder instead).
Step 4 — Configure CloakMail
With the extension loaded and your Cloudflare credentials ready, wire everything together.
Click the CloakMail icon in your toolbar. On first launch, it opens the setup wizard automatically. Fill in these four fields:
| Field | What to Enter |
|---|---|
| API Token | The Cloudflare token from Step 2.5 |
| Zone ID | Copied from the Cloudflare sidebar (2.6) |
| Alias Domain | e.g. mail.yourdomain.com |
| Forwarding Email | Your real inbox, e.g. you@gmail.com |
Click Test credentials — CloakMail will call the Cloudflare API and verify your token, zone ID, and that Email Routing is enabled. All checks should show green.
Click Save & Finish.
Note: Your API token is encrypted with AES-GCM before being stored — it never leaves your browser except in direct calls to
api.cloudflare.com.
Step 5 — Using CloakMail
Generate an Alias
Visit any website, open the CloakMail popup, and click Generate alias. A Cloudflare routing rule is created in ~200–400ms and the alias is auto-copied to your clipboard.
github.com → github.x82s@mail.yourdomain.com → you@gmail.com
amazon.com → amazon.k29s@mail.yourdomain.com → you@gmail.com
example.com → example.f73m@mail.yourdomain.com → you@gmail.com
Each of those is a real, dedicated Cloudflare routing rule — not a catch-all.
Autofill on Signup Forms
CloakMail’s content script detects email input fields and injects a small shield icon next to them. Click it to generate and fill an alias in one step — no popup needed.
Manage Your Aliases
Open the Aliases tab to see all aliases. Tap any one to expand its controls:
| Action | What Happens in Cloudflare |
|---|---|
| Disable | Rule turned off — mail is silently dropped |
| Block | Rule action becomes drop — permanently ignores mail |
| Delete | Rule deleted — mail bounces with a 550 error |
| Enable | Rule turned back on |
Sync with Cloudflare
If you’ve changed rules manually in the Cloudflare dashboard, click Sync in the popup to reconcile local state with live Cloudflare rules.
Backup Your Aliases
Go to Settings → Export Backup to download a JSON file of all alias metadata. The API token is excluded from the export.
How CloakMail Keeps Your Token Safe
The Cloudflare API token is sensitive. CloakMail encrypts it before touching storage:
// Derive AES-GCM key from a per-install ID using PBKDF2
const key = await crypto.subtle.deriveKey(
{ name: "PBKDF2", salt, iterations: 310_000, hash: "SHA-256" },
keyMaterial,
{ name: "AES-GCM", length: 256 },
false,
["encrypt", "decrypt"]
)
The encrypted token lives only in the background service worker — content scripts (which run in website contexts) never see it. No data leaves your browser except direct calls to api.cloudflare.com. No analytics, no telemetry, no external database.
FAQ
Does this work without a custom domain? No — you need a domain on Cloudflare with Email Routing enabled. That’s why Step 1 covers getting a free one from Stackryze.
What happens to mail sent to a deleted alias? It bounces at Cloudflare’s MTA with a 550 error. As long as catch-all is not enabled on your alias subdomain, no mail gets through.
Can I use multiple domains? Not yet — multiple domain support is planned for v2.
What’s the alias limit? Cloudflare’s free plan supports up to 200 routing rules. Paid plans go up to 1,000. CloakMail tracks your count and warns you before you hit the limit.
Is this affiliated with Cloudflare? No. CloakMail is an independent open-source project that uses the public Cloudflare API.
Wrapping Up
Once this is set up, every signup from here on gets its own alias. Leaked data from one breach can’t be used to spam your other accounts. You know exactly which service sold your data. And killing a spammy alias takes one click.
Everything here is free — a free domain, a free Cloudflare account, and an open-source extension.
- Project page: ankitmaurya.pages.dev/projects/cloakmail
- GitHub: github.com/MauryaAnkit/Cloakmail
- Free domain: domain.stackryze.com