Surfshark’s Alternative ID hands you an address you can give to a website instead of your own. Comparing alternate email identity vs personal email address is usually framed as a privacy question, and it is, but the part that decides how well it works is mechanical: a mask is a forwarder, and forwarding is a specific operation with specific consequences for whether mail arrives at all.
This is an independent editorial review. Surfshark did not review or approve this article.
Surfshark B.V. is registered in Amsterdam and the product pages quoted here are its English-language, US-facing ones; the standards documents quoted below are published by an international engineering body rather than by the vendor, and they describe how mail systems behave in general rather than how any one provider’s forwarding is configured.
You can see Surfshark’s current Alternative ID lineup on its official site:
Reading alternate email identity vs personal email address in one table
Compare the two on what each one actually does, rather than on how private each one feels.
| Property | A masked alias | Your own address |
|---|---|---|
| What the sender records | The alias string | Your real mailbox |
| Delivery path | Relayed, then forwarded to you | Direct to your provider |
| Sending and replying | Not described on the product pages | Native |
| Exposure in a breach of the site | The alias leaks | Your mailbox leaks |
| Turning it off | Pause or delete the alias | Filtering, or a new address |
| How many you get | Up to three masks | One identity |
A masked address is a forwarder, and that is the whole design
Surfshark describes the product plainly. It lets you “Create an alternative email address that forwards messages to your primary inbox,” and once it exists, “any message sent to your alternate address is automatically forwarded directly to your primary inbox.” The privacy claim follows from that: “The sender only ever sees the alias, keeping your personal email address private.” The company says you can “Generate up to three unique email masks,” and that masks can be paused or deleted at any time.
The support documentation adds what the masks are for in practice. Alternative ID “generates a brand-new online identity and an email to use online,” it can “generate an alternative persona (name, date of birth, address),” and when you register somewhere with it, “all of the login emails, 2FA, or verification emails will be forwarded to your inbox.” Using it requires an active Surfshark subscription.
Read those sentences closely and one direction is missing. Every description is about mail coming in. Neither the product page nor the support article states that sending or replying from a mask is supported. That silence is worth taking seriously rather than assuming either way, because it is the single property that decides whether an alias can carry a real correspondence or only a signup.
What forwarding does to the checks that decide delivery
Here is the part no feature table mentions. Mail systems decide whether to trust a message using sender authentication, and those checks were designed around a message traveling from its origin to its destination. A forwarder sits in the middle of that path.
The engineering standard that exists specifically because of this problem is RFC 8617, which defines the Authenticated Received Chain. Its introduction states that SPF and DKIM authentication “is impacted by the processing of Internet Mail by intermediate handlers,” and that “Failures of authentication caused by the actions of intermediate handlers” “can cause legitimate mail to be incorrectly rejected or misdirected.” It also notes that DMARC “also relies upon SPF and DKIM authentication mechanisms,” so a failure upstream propagates. ARC exists to provide “an authenticated ‘chain of custody’ for a message.”
Why does an intermediate handler cause trouble? Because of what the older check actually authorizes. RFC 7208 defines SPF as a protocol by which domains can authorize hosts “to use their domain names in the ‘MAIL FROM’ or ‘HELO’ identities.” It is a statement about which machines may send for a domain. The same document observes that “the domain ‘A’ cannot reliably use a redirect to another domain ‘B’ not under the same administrative control.”
The practical consequence for a mask is this: a forwarded message reaches your provider from the forwarder rather than from the original sender, and your provider is evaluating a path that the original sender never authorized.
Where alternate email identity versus personal email address stops being a privacy question
Put as alternate email identity versus personal email address, the trade is not privacy against convenience. It is privacy against delivery certainty and reply capability.
A mask genuinely does what Surfshark says it does at the point of signup. The company’s framing is accurate: “if a website you signed up for suffers a data breach, hackers only get your masked alias, not your primary email address.” An alias you can delete is a tap you can close, which your real address is not.
What you take on is a longer delivery path with more that can go wrong, on exactly the class of mail you least want delayed. Surfshark names that class itself: login emails, two-factor codes and verification messages. A verification code that arrives late or lands in a spam folder is a locked account.
The difference between alternate email identity and personal email address, in practice
The difference between alternate email identity and personal email address comes down to three structural properties rather than to a privacy score.
- Ownership of the string. A mask belongs to a service and lives while your subscription does. Your own address is yours.
- Direction. A mask is documented as receiving. Your own address sends and receives without question.
- Revocability. A mask can be paused or deleted the moment a list gets noisy. Shutting down a real address costs you everything attached to it.
Ownership is the one people underrate. Anything you register with a mask is reachable only while the mask exists, so a subscription lapse and an account recovery can collide.
Choosing alternate email identity or personal email address for beginners
If you are weighing alternate email identity or personal email address for beginners, sort by how much the account matters rather than by how private you want to feel.
- Use a mask for one-off signups, trials, downloads and anything that smells like a list.
- Use your real address for banking, government, employment and your password manager.
- Before you rely on a mask for anything with two-factor codes, send a test and watch where it lands.
- Note which accounts are tied to which mask, because three masks become hard to track quickly.
- Keep at least one route into every important account that does not depend on a subscription.
Frequently Asked Questions
These are the questions that decide whether a mask fits the way you actually use email.
Can I reply from an alternative email address?
The product and support pages describe forwarding into your inbox and do not state that sending or replying is supported. Treat a mask as inbound until you have confirmed otherwise in the app.
Will messages to a mask end up in spam?
Forwarding adds a handler to the delivery path, and the ARC specification exists because authentication failures introduced by intermediate handlers can cause legitimate mail to be rejected or misdirected. Test before you depend on it.
How many masks do I get?
Surfshark states you can generate up to three unique email masks, and that they can be paused or deleted at any time.
Does a mask hide anything from the service running it?
It hides your address from the site you registered with. The forwarder necessarily handles the mail in order to forward it, which is what makes the feature work.
Bottom line
A mask changes who learns your address, and it changes the route your mail takes to reach you. The first is the benefit, the second is the cost, and the cost falls hardest on verification mail. Use masks where a lost message is an inconvenience, and your own address where a lost message is a locked door.
You can see Surfshark’s current Alternative ID lineup on its official site:
