A message turns up for something you never signed up to. It might be a marketing pitch from a company you have never heard of, or an extortion mail quoting a password you stopped using years ago. The first question almost everyone asks is the same one. Which company did this. Who took the address you handed over in good faith and let it go.
It is a reasonable question, and in nearly every case it has no answer. Not a difficult answer. No answer. If one address has been given to two hundred companies over fifteen years, an unwanted message arriving at that address names nobody. It is evidence that the address is in circulation, which you already knew the moment the message appeared.
There is a method that gives you a near-exact answer, it is not complicated, and it costs very little. The catch, which this post will not bury in a footnote, is that it has to be in place before the leak. It does nothing at all for the address you already use. If your problem is that an address you have had for a decade is now on lists you cannot see, attribution is the wrong project, and containment is the right one.
Why you cannot trace it after the fact
An email address is a shared key. Every company you gave it to holds a copy, and so does every party they passed it to in the ordinary course of business: the mailing platform, the CRM, the analytics vendor, the agency running the campaign, the company that acquired them three years later. None of those handovers is a leak. All of them multiply the number of parties who could have been the source of one.
The message itself carries nothing that narrows it down. SMTP was never designed to prove who sent anything. The standard says so in plain language, noting that mail is inherently insecure and that it is feasible for even fairly casual users to negotiate directly with mail servers and produce messages that appear to have come from somewhere else. Headers can show you the route a message took, and often the platform it was sent through. They cannot show you where the sender obtained your address, because that fact was never part of the message.
Nor can the sender usually tell you, even if they answer honestly. Address lists are assembled from many places and resold. Have I Been Pwned keeps a separate classification for what it calls spam lists, precisely because that data is aggregated from multiple sources and used to send targeted mail, with no single origin to point at.
Breach lookups are worth running, and they answer a different question from the one you are asking. They tell you that your address appeared in a corpus somebody published. They do not tell you that the corpus is the source of the message in front of you, and a clean result proves very little. Have I Been Pwned is explicit that it holds a small subset of all the records breached over the years, because many breaches never result in a public release at all.
The forensics that half work
The classic technique is plus addressing, and it deserves to be understood properly rather than waved away. RFC 5233 calls it subaddressing: you take the local part of your address and append a separator and a detail, and mail sent to the extended address still reaches the same mailbox. Google's documentation for Workspace users describes the mechanism directly, saying that messages sent to your current address or any variation with the plus sign all arrive in your current inbox, and that you can then set up filters based on the address. Microsoft has it enabled by default in Exchange Online. Give a different detail to each company, and if mail turns up at one of those addresses from somewhere unexpected, you have a name.
That is genuinely useful, it costs nothing, and if you do only one thing after reading this, do that. But be clear about where it breaks.
- The tag is removable, and removing it is trivial. Your real address is everything before the separator. Microsoft's own documentation describes Exchange resolving the full address first and, if that fails, trying again without the plus sign and tag. Any list broker or data cleaner can normalise addresses the same way, and if they do, your attribution vanishes without telling you.
- It is not a universal convention. RFC 5233 describes the plus sign as only one common way of encoding the detail, and its own second example uses a different separator entirely. The RFC adds that where a separator appears more than once in the local part, the logic used to split the address is implementation-defined and usually depends on the encompassing mail system. Not every provider uses a plus, and not every provider supports the idea at all.
- Signup forms reject it. That is a validation choice rather than a standards question: the HTML specification's own definition of a valid email address permits the plus sign in the local part, and its reference expression includes it. The site is simply wrong, which is no help to you at the point of signup. A form refusing your address is its own separate problem.
- An administrator can switch the whole thing off. Exchange Online exposes a single organisation-wide setting that disables plus addressing for everybody.
- It is receive-only. Microsoft states plainly that users cannot send email from plus addresses, so any reply you send comes from your real address and puts it straight back in front of the recipient. A forwarding alias handles the ordinary case, because the reply address is rewritten on every forwarded message and hitting Reply in any mail app reaches the sender showing only your alias. Reply All is the documented exception: the other people on the thread are ordinary addresses in your mail app, so replies to them still go out from your real account. Starting a new conversation as the alias is a different thing again, and needs per-alias SMTP.
- It has no off switch. Once a tag has been burned you can filter it, but the mail is still accepted and the underlying address is still perfectly valid. You cannot retire the detail without retiring the mailbox.
Plus addressing does tell you who leaked you, in the cases where the tag survived the journey. That is a real result with a real gap in the middle of it.
The method that actually works, and its honest catch
The reliable version of the same idea is to make each address a separate address rather than a variation on one. A unique address per site, at a domain you control or through a forwarding alias service, with no shared root that anyone can strip. The tag is not decoration attached to your address. It is the whole address.
The reason this works is not clever. It is that only one explanation exists. If mail arrives at an address you created for a single retailer and used nowhere else, that retailer is the only party who ever held it. There is no competing hypothesis to weigh, no question of whether a tag was normalised somewhere in the chain, and nothing to argue about when you write to them. The attribution comes from the discipline of never reusing an address, not from any technology.
Now the honest part. This is purely preventative. It gives you nothing about the address you already have, because that address is already wherever it is, and no new alias reaches backwards to unpick that. Attribution starts on the day you start, and only for relationships you begin afterwards. Existing accounts can be migrated one at a time by changing the address on file, which is slow and worth doing only for the accounts you actually care about.
It is also discipline rather than automation. Nothing enforces one address per site. Reuse one across two companies and you have rebuilt the original problem in miniature for those two. This is the same reason a second inbox does not achieve it: one extra address shared across thirty sites is thirty companies deep on its first day.
If the per-signup admin is what puts you off, a catch-all on your own domain lets you invent an address at the counter without registering it first. The price is that anything at your domain reaches you, including addresses a spammer guessed, so the record gets noisier and the inference gets weaker.
Reading a delivery log like a ledger
Attribution is not a single moment of discovery. It is a record you can look back through. What you want at minimum is the address a message arrived at, the sending domain, and the date it first appeared. Three patterns are worth naming.
- Mail from a sender with no relationship to the company an address belongs to. If the address exists only for a hardware shop and the message is a crypto pitch, the address has left the shop.
- First contact at an address that has previously seen nothing but transactional mail from one sender. The quiet history is what makes the new arrival legible.
- The same unrelated sender turning up at several of your per-site addresses inside a short window. That does not point at one company. It points at something they share: a common mailing platform, a common agency, or a list built by aggregation. This is the inference a single address can never support, and the reason keeping the record is worth more than catching one message.
Weigh volume and timing before concluding anything. One unexpected message at one address can be a lucky guess against a common word, particularly on a catch-all. A sustained pattern is not.
Delivery records are also finite. A good alias provider keeps delivery metadata for a bounded period and then discards it, which is the correct behaviour for a service that should not be accumulating a permanent history of who writes to you. It does mean your ledger is a rolling window. When you see something you might want to act on, save the message and note the date yourself rather than assuming the log will still hold it in six months.
What attribution is actually worth in practice
Modest things, and they are still worth having.
First, an erasure request with a name on it. Under the GDPR you can ask a company to delete your personal data, and the Irish Data Protection Commission lists the grounds, which include withdrawing consent where no other lawful basis applies and objecting to processing for direct marketing. A request has to be addressed to a controller, and knowing which company received the address is exactly what lets you address it. The organisation must respond without undue delay and within one month, extendable by a further two months for complex or high-volume requests, provided they tell you inside the first month. The GDPR page sets out the same rights in plainer terms.
Second, a decision about the account. If a company sold or lost the address, you have learned something about how it handles data that its privacy policy did not tell you. Closing the account is a reasonable response, and knowing which account to close is the entire difficulty.
Third, a complaint a regulator can act on. Supervisory authorities take complaints about named controllers. A complaint saying that spam arrived and you are not sure who is responsible has nowhere to go.
Fourth, and most commonly, simply knowing. It changes who you hand an address to next time, and it settles a question that otherwise sits unresolved for years.
What attribution does not do is get your data back. Copies exist. An erasure request obliges one company to delete what it holds. It does not reach into the lists that company already sold. Treat a name as information for future decisions rather than as a remedy.
You caught one. Now what
- Switch the address off rather than filtering it. A filter means the mail is still accepted and still delivered somewhere. An alias with a real kill switch refuses the mail at SMTP time, so the sender gets a rejection at the door and nothing is queued or filtered. Check which behaviour your provider offers, because some only discard the message after accepting it, which leaves the sender believing the address is live.
- Save the evidence. Keep the message with full headers, and note the date the address first received something unexpected. If you complain later, that is the whole case.
- Send the erasure request and quote the address in it. An address you created for one company is unusually strong evidence, because there is no plausible story in which they got it somewhere else.
- Do not reply, and do not use the unsubscribe link on mail you never solicited. Both confirm the address is live and read.
- Rotate if you want to keep the relationship. Create a new address, change it on the account, and retire the old one once you have seen the new one working.
None of this recovers the address you have been using since school. That address is where it is, and it is not coming back. What the method buys you is that the next unwanted message arrives with a name attached, and a name is something you can act on.