Show HN: I wrote an email app that accepts only one sender per inbox (clova.email)

Glad to know it's working for you!

Email at least you can set this up with a rule that checks the sender against your contacts and throws them into some folder.

I hope so too. I hope I have the right set of features so far. Happy to hear thoughts and early feedback.

That defeats the purpose. If I have an email, I want to be reachable. We just need a good spam detector...oh wait, that's pretty much solved already :)

Anyway, nothing against the posted project! I think it's cool.

This is what finally made email useful for me again. I use hey.com email and the Screener whitelist is probably the most important feature. (Selective notifications being the second most useful for me.)

I think this could work for text messages, too. All new texts could go to a screener and don't notify until you opt-in.

The email protocol allows all senders, but you’ve always had the option to configure your client to delete all incoming messages based on whatever criteria you see fit. Technically it still hits your email server but it’s effectively the same as what UX you want on client side.

That's so true. Gmail used to be cool, now it's old and clunky and their "unsubscribe" feature does not do that reliably. I want to tackle that next, look at domains that continue to email people after they unsubscribe.

If anyone is reacting to my emails, I'm not seeing it, might be some vendor-specific thing. Which is fine, I don't want that.

The more annoying thing is there's no obviously reliable way to prevent a sender from spoofing the address. Even Gmail/Gsuite will allow spoofed emails from the same domain, though it may flag them as spam.

On the "+" sign comment: I find that many spammers already know the trick. That's why I built a prefix where any suffix will work. If you have "turtle" as a prefix, you can add "turtle$bank", "turtle-barber", etc on the spot, without having to create each suffix.

As for single sender, we attach to the domain, so *.github.com would be allowed. The main problem, to be honest, is when email comes from apple.com, icloud.com, applehq.com, etc. I'm considering a power-feature where you could pre-select a few domains or allow all and then lock it. I feel it would be best for power users only. What do you think?

I assume spammers have become adept at stripping anything between + and @ in email addresses, so this isn't as reliable as properly masked addresses.

I think the benefit is supposed to be the locking feature. Any human that sees myemail+chase@domain.com and wants to circumvent your filters to get to your main inbox (typically for sales purposes) can figure out to email myemail@domain.com. With this product, the email is undeliverable unless they label their emails correctly.

It aims to be simpler. It's not a mask. It has forwarding as an option but the idea is that you can use one of the inbox types for different needs. The one I use the most is prefix, because you create it once and then you can tack on any suffix to it. When the first sender reaches you, that suffix become locked to their domain (or account, if it's a gmail, outlook, yahoo, etc). That seems pretty useful for subscriptions. For one-time codes, just create a temporary one every so often. It has the option to delete itself (and optionally take the email with it).

[delayed]

Agents can create new inboxes and inboxes can be of 3 types, besides "Permanent" which is just a regular inbox. The other types don't have "rules" that you can customize. Instead the rules are baked-in: Temporary -> expires after some time, One-sender: allows only one sender (the first one to prove its email identity), Prefix: similar to one-sender but creates a new inbox for every suffix (and if spammers catch on to the prefix, you can delete it and create a new one).

It doesn't right now. I'm thinking about options and so far all seem either "too much work" for the user. A few options:

1) a button to release the lock and allow the next sender to lock it again (only works for renames like you mention, facebook.com -> meta.com but not for apple.com and icloud.com sending together).

2) A button to manually add related domains. This is too much work because users can't guess new domains easily. I had betterstack.com email me as that and also as betterstackhq.com.

3) Allow up to 3-5 domains and let users block them manually. I feel this option is what permanent inboxes are for -- Clova already has an option to block entire senders (the whole domain or just a user).

4) Plugin some logic or AI in the backend to help categorize things together and understand that betterstack.com and betterstackhq.com are the same thing, apple.com, icloud.com etc are related, etc.

Anything else?

> It may seem a bit unusual

met someone a few weeks ago. They said their email address is @<german ISP>.de but half the time they're sending from @icloud.com, I guess because they have an phone from Apple and don't understand the settings

I volunteer at a library where people can come with tech questions. Just last week, someone asked to help sort out their email addresses because they have various, from Microsoft, from an ISP, and because they have an Apple phone of course Apple also pushed an icloud address onto them that they didn't want

Seems quite common to have a second sending address with how Apple is pushing its lock-in (email addresses are some of the hardest things to migrate)

>think of like Facebook originally sending from facebook.com

ahem, didn't they originally send from thefacebook.com ? (back when facebook.com was owned by someone else)

That's a clever idea. We implemented it now. One-sender and Prefix inboxes now allow you to manually add up to 5 whitelisted senders. The only friction is that you need to know their contact information (domain names at least) before you whitelist. One option we've been investigating is auto-accepting some senders for some time and allowing you to confirm them. Thanks for the suggestion.

I built https://statphone.com which is one emergency number that dials multiple people and shows up as itself on the caller ID so you know it's urgent.

You can use the same tech to build throwaway accounts like you are envisioning. Problem is that it would be prohibitively expensive.

You must love all the spam you're getting with a catch-all!

Same - very easy to setup with Cloudflare Email Routing and no fees. All email gets forwarded to an obscure Gmail, and use Amazon SES for sending emails (also ends up being free due to super low volume of emails).

Same. I've done this for years with my crappy namecheap web host email. Works great. Pro tip. Just setup a subdomain on a domain you already own. This makes filtering even easier.

Yes, but replying can be a pickle.

Isn't that a gmail-only feature?

I remember a scheme from the 90s that put a keyed hash in there - and a filter that only accepted valid ones - checked with a key. I think there was an optional date (valid-to).

So you might give someone an address like:

dell-rep-01012027-<hash>@anymail example.com

I used to do this when I could, but many poorly written email validators reject such addresses. (One service, Rappi, was so gloriously, hopelessly broken that they spammed me now and then at the address with a + in it but I couldn't use it to log in!)

Now I just use Fastmail's masked address feature. (And I do not use Rappi.)

I love this message. Your advice was:

* Actionable

* Constructive

* Succinct

* Borne out of relevant experience

And you were sure to thank them for the contribution. This is a model HN comment.

Ah, but Clova handles that. It locks to the domain, not the sender or the subdomain. So both your examples would still be allowed (citi.com and bankofamerica.com). There are also permanent inboxes in the system, which allow anyone. The trick is to delete them after a while when they get polluted with spam.