Gmail trick: multiplying your address

[PinguTS]

Incomplete Article for old well known stuff:

1. "Gmail has a wildcard for the + sign as it doesn't recognize it nor any characters that follow it." This wrong. It is well documented and called aliasing within Google. There is even a support page for it: https://support.google.com/mail/answer/12096?hl=en

2. Even that is documented: https://support.google.com/mail/answer/8158?hl=en

3. Even that is documented: https://support.google.com/mail/answer/159001?hl=en There are also a lot of ccTLDs that Google has for Gmail. Also those will work.

[danielweber]

Not everyone knows everything. I knew all of this, but lots of people don't.

If there's one thing I think I could change about HN, it would be that we'd be easier on people who don't know things. Many times I'll read an article about the new version of PolyDoopWerks, and be told that it's the Uber-of-OOD-builders, and have no idea what's going on.

[pyderman]

Yes, you're right about the support pages. I only knew about the "+" sign until now and it seems like lots of people didn't knew about this :)

[joezydeco]

I've seen some sites reject the + in email address forms. YMMV.

[jfoutz]

So a support page is what passes for documentation now?

[diggan]

Also called sub-addressing in RFC 5233[0] or Address Tags. Gmail is not the only one of the email providers that enables this. Yahoo, Apple, Outlook, Fastmail and others also support this. More information at Wikipedia: http://en.wikipedia.org/wiki/Email_address#Address_tags

[0] https://tools.ietf.org/html/rfc5233

[pyderman]

Nice! Didn't knew that other providers do it aswell.

[aiurtourist]

I highly recommend Sneakemail.com and have been using them for over a decade. They let you set up keywords, like "foo", and then you can mail [email protected] (or snkmail.com, since a few sites block the former domain) and it creates an alias. On the Sneakemail web UI you can enable/disable aliases and see recent mail. An alias can forward up to 5 people or so, and when someone sends you mail, if you reply you'll reply through Sneakemail.

Of course it's also worth mentioning Mailinator.com (one-off throwaway aliases, but public) and 10minutemail.com (super-disposable temporary email addresses).

[ryan-c]

I've also been using sneakemail for at least twelve years. They also let you set up addresses with a bunch of randomly generated letters/numbers that are opaquely mapped to you, but you have to log in to do that.

The only problem is that some sites ban their domains - in particular Adafruit does this (they banned existing use of it, not just new sign ups), and their support said basically "we won't whitelist your address even though you've been ordering stuff from us for over five years".

[darkstar999]

Also try 33mail.com for throwaways. You get a subdomain, so you can do [anything]@foo.33mail.com or [anything]@foo.33m.co

[pyderman]

Wow, awesome tips! Will check them out and write a follow-up

[dkopi]

//TODO: Check user_email for multiple variations of the same account by calculating and storing a canonical e-mail field in the DB as well.

[voidlogic]

Assuming you are trying to prevent people from creating multiple accounts on your service... keep in mind they could create e-mail forwarders at other domains, this just stops a very easy method.

Also, more importantly, this would have to only apply to a set a whitelisted domains, plenty of non-gmail systems would treat these variations as distinct addresses. So without a set of domains to apply this logic too, you could end up stopping users from registering with their own normal/actual address.

[ch4s3]

yeah, seriously.

[maxmcd]

For #2. The dots are completely irrelevant, so you can actually add and remove.

    [email protected]
    [email protected]
    [email protected]
    [email protected]

etc etc etc

[SippinLean]

Easier to just get a custom domain and set up a catch-all account to forward to your gmail.

This way you can do [sender]@domain.com, [company]@domain.com, john1, john2, [email protected] and never run out of options. If one starts spamming you can just stop a particular [company]@domain from forwarding.

[sinatra]

Keep in mind that catch-all accounts usually get a lot of random spam. If you're using this domain to signup for various services, at some point, spammers will become aware of it. And, they'll start sending a lot of spam to (random string that spammer comes up with)@your-domain.com.

[jj00]

I'm sorry, but I've grown to hate this feature. I keep receiving emails from accounts I didn't sign up for, only to discover the person (with a similar name) used an email address like "[email protected]" or "senordevelopez" and the site itself defaults to "gmail.com". These are not off-the-wall websites, I've had long conversations with Netflix and a satellite TV service. You'd be surprised how many website do not authenticate the email account given.

[kevin_thibedeau]

The simple solution to this is to request a password reset from that service and disable their account.

[pi-err]

I have found a few sites reject the + in gmail addresses. I also suspect most DB (or wannabe spammners) would know about this and remove anything after the + sign. Same goes for the "." trick. Still good to know though.

I'm now using Blur (https://www.abine.com/index.html). Very effective so far at creating aliases pointing to my real email. Only worried on how they'll fund their operations long term.

[palehose]

I have an application set up with Devise handling authentication for me and Devise allows me to create multiple accounts with the same email address. Considering how commonly used Devise is for setting up a site with Ruby on Rails, this is a huge open hole for a lot of websites who might not appreciate multiple user accounts tied to the same email.

[thrownaway2424]

It kinda bugs me when people describe +foo as a "gmail trick". That type of addressing predates gmail, and exists outside of it still. In fact the plus is not the only form of this. qmail uses the dash, and postfix allows you to configure anything as a separator.

[penguat]

I'm using the '+' for automating email tests - using that and Gmail's API I can set up asynchronous tests against unique email addresses, and test them as they arrive. This is a crucial part of integration testing with partner companies.

[gohrt]

This is why email is wonderful. It works so well that people are marveling about learning standard features that were deployed before they were born.

If only we stuck to a few good ideas instead of overwhelming ourselves and each other with bad ideas.

[amouat]

I use the + trick, but several signups don't allow the + sign in e-mail addresses.

[lost_name]

I've run into a situation where I was able to sign up using the + in the e-mail, but not login (or unsubscribe from their newletter) with the same address.

[cfontes]

What I want is something like a 10-minute-mail inside my gmail account!!!

[sp332]

Yahoo Mail does this. You can make a specific new address and then delete it when you're done. https://help.yahoo.com/kb/mail/SLN3523.html

[sethrin]

I just use mailinator. No charge, no hassle, you don't have to set it up first. Half the time I don't even end up checking it. So far I don't really have a use case for plus addressing.

[pyderman]

Yes, that's on my wishlist too!

[paulrr]

I never understood why people rely on the + trick to determine the source of new spam. Wouldn't a smart spammer / list-seller simply strip the suffix from all @gmail.com addresses?

[mbertrand]

I've thought the same thing since I encountered this trick a few years back. My guess is that most email providers don't allow the use of a "+" in the address and as a result its viewed as a fringe case and not accounted for.

[danielweber]

It's not a valid way to test for illicit spam, but it's a good way to help keep honest people honest.

There are researchers who make brand-new addresses and put them in various places as a tripwire for spam.

[jpalomaki]

According to my experience quite many email address validators on web sites don't consider the address with "+" as valid.

[tzury]

I used to send it at mailing lists and sign-ups.

However, I Noticed spammers have learned the trick and omit the "+..".

[kps]

  >  I Noticed spammers have learned the trick and omit the "+..".

If you control your own email,

1. Configure a different character, e.g. ‘-’, as your subaddress separator.

2. Set up ‘[email protected]’ as a spam trap.

3. Set up ‘[email protected]’ as an email address.

4. Provide ‘[email protected]’ externally.

[rMBP]

I'm running my own email server and use the dash/minus - instead. Works great.