A live mask accepts mail at RCPT TO and delivers to its owner, with an X-Masked-Email header naming it. A disabled mask files straight to Trash, past the owner's Sieve script. Deleted and expired masks are refused like unknown addresses, without being cached as unknown. Mail moves lastMessageAt and turns a pending mask enabled. Sub-addresses on a mask work.