Source tracing · From address to evidence
You just signed up for a website, and now an unfamiliar promotion lands in your inbox. Did that site expose your email address? The timing may be worth noting, but neither the sender name nor the arrival time proves who was responsible. First, confirm which address actually received the email.
No email address or message content is collected. This check runs locally on this page.
Assess first, then share an address
Think about where you entered the address that received this email. Not every address points back to one website. If you’re unsure, keep that uncertainty in your notes instead of jumping to a conclusion.
An unexpected ad sent to your usual inbox only shows that the sender got your address. It could have come from an old signup, a public profile, an address guess, or someone passing it on.
If you can verify that you used it on only one site, the alias match narrows your search to that signup and related handling. It still doesn’t mean the website deliberately sold your address.
An alias still keeps your real address private, but it can only point to a group of websites. Once you reuse it for shopping, communities, or surveys, it no longer identifies a single source.
Interactive check · Runs locally
This check doesn’t assign blame. It uses the information you have to suggest what to check first. You can answer honestly even if you don’t have signup records or haven’t checked the recipient address yet.
Check the recipient details in your email app. If the message was forwarded, the ordinary “To” field may not show the address that actually received it. For a Letterfwd alias, check the matching entry in your forwarding archive first.
See an example archive checkEvidence guide
Keep “what I saw” separate from “what I think happened.” Address sales, partner notices, authorized sharing, public collection, and data leaks are different scenarios. One marketing email alone can’t tell them apart.
| Clue | What it can support | What it can’t prove | What to check next |
|---|---|---|---|
| A unique alias received the email | If you truly used it on just one site, check that signup and related handling first. | On its own, it can’t prove a leak, a sale, or who was responsible. Rule out reuse, public exposure, and forgotten uses first. | Check the address saved on the website and your signup records. Keep the ad’s actual recipient address, sender address, and time. |
| Similar sender domain or name | A starting point for checking whether the sender is connected to a brand or whether the email is genuine. | Display names can be spoofed. Similar domains don’t prove that two organizations are connected or share data. | Visit the official website using a known address and check your account or contact support. Don’t sign in through a link in an unexpected ad. |
| Signup and ad arrived around the same time | Can help you prioritize checks and build a timeline to investigate. | One event following another doesn’t prove causation. An old subscription could simply have sent an email at that time. | Check the earliest message, past subscriptions, and consent dates—not just the latest email. |
| Written confirmation from the service | Specific details about the data source, recipient, processing date, or scope of an incident can provide more direct evidence. | A general statement about sharing “with partners” or a policy without details about a specific incident doesn’t confirm this leak. | Keep the full reply and distinguish confirmed facts from open questions. If needed, consult your local data protection authority. |
You could ask the relevant service: “I used this unique alias only for my account on your site. Please confirm whether the sender was an authorized partner and explain the source of this address and the basis for processing it.” Keep the reply, and redact unnecessary personal information.
30-day forwarding archive / check notes
marketnote27@letterfwd.com“A shopping website · The address linked to the account matches this alias.” This helps connect the records, but it does not establish responsibility on its own.
This example shows how to check. It doesn’t connect to your account or display real archive data.
Check in the console
After logging in, find the message in your 30-day online archive and check the recipient alias, full sender address, and time. Sender details can be spoofed, so don’t rely on the display name alone to verify who sent it.
Open Alias Management and check your 30-day archive. Search by subject or time and note the alias it was sent to. If there’s no record, don’t assume that means the message was never delivered.
Use a saved link to the official site to check the email address on your account, then compare it with your signup confirmation or personal notes. Check whether you also used the alias for surveys, promotions, or other sites.
Save relevant dates, addresses, and replies from the service. Messages older than 30 days aren’t available in the online archive. Save anything important yourself promptly; the archive isn’t a permanent backup.
Limit unwanted mail
Stopping unwanted mail and determining responsibility are separate issues. You can reduce the disruption before tracing the source, but first make sure you won’t miss order updates, bills, or account recovery emails if you pause the alias.
If the alias is still used for orders, payments, renewals, or account recovery, change it on the website to another unique alias first, then complete any email verification the site requires.
Pausing stops future forwarding from that alias, and you can reactivate it if needed. Delete it only when you’re sure you won’t use it again. If several sites share the alias, this affects mail from all of them.
Make your next signup easier to trace
A unique alias can make future emails easier to trace, but it can’t track where an old address has already spread. Keep a record of which alias you used for each site, then decide whether to pause it based on the emails you receive. An address match alone doesn’t prove a leak.
Log in with a verification code sent to your usual email. Manage up to 100 forwarding aliases without changing your real email address.