Ghost Mail is a free and open-source iPhone app to manage email alias' for Cloudflare hosted domains. It lets you quickly create disposable email addresses on the fly, shielding your main email from unwanted messages, data breaches, tracking and targeted ads. With full open-source transparency enjoy peace of mind knowing that your primary email address is being kept private!
Ghost Mail Features:
- 📵 Easily ghost spammers by disabling or deleting aliases
- ✉️ Create private email aliases on the fly
- 🔒 Protects your main email from being exposed in breaches
- 🛠️ Verifiable 100% open-source software with no paywalls
- 📋 View all of your email aliases while offline
- 📨 Add multiple email domains
- 💾 Sync to iCloud + CSV import/export
- 📧 Send email from email aliases
- 📨 Email analytics and charts
- You must have a domain hosted by Cloudflare - https://cloudflare.com/
Cloudflare.com > <domain.com> > Email > Email Routingmust be enabled- At least 1 verified destination email addresses must have been created:
Cloudflare.com > <domain.com> > Email > Email Routing > Destination Addresses
Log in to your Cloudflare dashboard, choose a zone/domain, and copy Account ID and Zone ID from your domain's overview page.
Go to Profile > API Tokens > Create new token (then choose Custom token)
Token Permissions:
- Account > Email Routing Addresses > Read
- Zone > Email Routing Rules > Edit
- Zone > Zone Settings > Read
- Zone > Analytics > Read (OPTIONAL but recommended: Required for email statistcs and charts)
- Zone > DNS > Read (OPTIONAL: Only required subdomains are going to be used)
CSV formatting is as follows, note the optional fields:
Email Address,Website,Notes,Created,Enabled,Forward To
user@domain.com,website.com[optional],notes[optional],2025-02-07T01:39:10Z[optional],true,forwardto@domain.com
CSV import notes:
- On import, the app infers the target zone from the email domain in
Email Address. - If no configured zone matches the email's domain, the current primary zone is used as a fallback.
- Imports will update and overwrite existing; review after importing.
- Ghost Mail does not have any servers or infrastructure that it connects to.
- The iPhone app connects directly to Cloudflare using your API token with minimal permissions, no middle man.
- Cloudflare token is stored securely in the iPhone keychain.
- SMTP credentials (if confgiured for sending email) are also securely stored in the iPhone keychain.
- Email aliases and metadata (website, notes, date) are optionally synced to your iCloud account for backup purposes. This can be enabled/disabled in settings.
- Ghost Mail does not use any servers or external infrastructure; all actions happen directly from your device.
- The app talks directly to Cloudflare using your API token with minimal required permissions; there is no intermediary service.
- Your Cloudflare API token is stored securely in the iOS Keychain.
- SMTP credentials (if you configure sending email) are also stored securely in the iOS Keychain.
- Email aliases and their metadata (website, notes, dates) can optionally sync to your iCloud account for backup; you can turn this on or off in Settings at any time.
Email aliases protect your primary inbox from spam, phishing, and long-term exposure. Instead of handing out your real email, you give out an alias that can be turned off or deleted if abused. This helps maintain privacy and reduces the risk of account compromise.
- CISA guidance: Reducing Spam – U.S. Cybersecurity & Infrastructure Security Agency warns against exposing your primary email address publicly.
- Expert opinion: Brian Krebs on Email Aliases – Security journalist Brian Krebs outlines the advantages and trade-offs of using aliases.
Aliases act as disposable shields for your identity, keeping your real account secure while still letting you receive messages when you want.