x:MaskedEmail is no longer refused as unbuilt. Creates generate the address on an allowed domain and check the prefix, maxMaskedAddresses and the create rate; updates keep server-set fields; enabled reads and writes map to the shared state; query filters on enabled, forDomain and text; a tenant administrator reaches its tenant's accounts' masks.