hey there, i did something similar, but i run my own email server and setup the alias system by myself using postfix and dovecot. cost for domain depends in the domain, the cheapest one i have is 7$ per year. running a mailserver on a vm is like 5$/month or more. i also immediately move my emails from that vm to a raspberry pi running in my home, so i have physical access at any given time and i can literally use the cheapest vm as data is only stored on it for a few seconds.

i currently maintain my list of aliases in the “tables” app on a nextcloud instance on that same raspberry pi, so i can add or remove postfix virtual aliases from my cell, i use a pythkn script to read that mysql table and extract what is needed to create the virtual alias for postfix which is then synced to the vm via csync2

whenever spam arrives, i just change the address at the page/newsletter/shop where it was leaked, change my password there and tell the pageowner that they had a data leak.

i nearly get no spam at all, but when, i know who leaked my data, so i consider this sort of an advantage.

in my database i have the (automatic) creation date, switch if its enabled or disbaled, the date of deactication, i also added a ‘notes’ column for things like why i disabled it, when i asked for a password reset but didnt get an email so that when i finally deacticate it, i have sort of a documentation when and how i tried to delete the account (when the page is sort of dead for example) i also have a switch to which of my real accounts (not aliases) that alias belongs, so i have a postbox for important emails (server administration, access to providers management systems) and i.e. one for less important things like shops, newsletters etc.

creating single aliases for each newsletter was over the years a lot of work but always only when setting it up a few seconds, so no big deal. however after decades of doing so, i figured out that this is a very good documentation of where i have accounts etc. it WAS a big deal however when i wanted to clean things up, move those aliases from multiple domains to a single one, delete accounts i dont need any more, change passwords (possibly to better ones) and add passkeys or totp where possible in one go. that was a lot of work and i only have few aliases left, one company i.e. that lets me reset the password, login with it, but when i try to delete my account, they claim they witnessed “suspicious behaviour” and lock my account again, i guess they never implemented account deletion and try to cover that with abuse of their so cslled “security concerns”. well, some providers are more difficult than others. those are the main reason why my cleanup still isnt done completely yet