The per-listing relay is the smart part, since it stops one leaked address from linking all of a seller's ads. Adding a short expiry or a simple reply cap would also help keep the relay from being reused for spam.
Thanks Rishabh — you've isolated exactly why I went per-listing instead of a single alias: the blast radius of one leaked address is one ad, not the seller's entire identity.
On expiry and caps: closing a listing already kills its relay — forwarding stops in both directions — which covers the "sold the bike three months ago" case. Time-based expiry is the natural next step; the open question is tuning it so slow-moving items (cars, apartments) don't go silent while the seller still expects replies. A hard reply cap is trickier — it can punish legitimate buyers mid-negotiation. My current lean is expiry-with-extend, plus the spam report button that's already live.
All of this is on the post-launch list. appreciate the sharp read!
Expiry-with-extend makes sense, especially if an extension follows a real reply rather than just resetting the timer. That way slow listings stay live while they are still being negotiated, without reopening a dead relay for good.
That's the refinement I hadn't articulated — renewal tied to a real inbound reply, not just a timer reset. It solves the gaming problem for free: nobody can extend a dead relay by sending an empty email, because the trigger is the conversation itself.
Implementation-wise it's cheap too — the forwarding pipeline already touches every inbound mail, so "did a real reply arrive in the current window" is one flag away. The residual question is spam-triggered renewals, but between the spam report button and capping renewals per buyer address, that's manageable.
Adding it to the post-launch list next to expiry-with-extend. This thread genuinely shaped the roadmap — thanks.
That cap per buyer address should handle most of it, especially if only replies that pass the spam filter count toward renewal. A flagged message then cannot keep a dead relay alive on its own.