Now if only websites will stop rejecting plus-addressed email addresses as invalid. The most frequent offenders are mom & pop websites that you just _know_ are going to get breached.
I use shopname@firstname.lastname.email, with my own lastname.email domain. Fastmail makes configuring your dns records for this super simple.
It's always fun interacting with customer service reps when they for example confirm my email address... "errrrrr yeah so we email you at ourname@...?"
Did you find anything interesting? I started doing this recently and did not find anyone misusing my email so far and am now wondering if it's worth the extra effort.
For alias addresses they are filtering that because the data thiefs and middlemen know a small portion of people do this. They cut off the plus or dot part when your domain has a well known MX/MTA connected to it.
That still leaves custom mailservers and non-alias (as in aliases via plus or dot, not actual mailserver aliases) which does give an indication as to who is sharing your data.
Not OP, but I'm guessing because it's easier to remember than completely random email address (password manager might solve this?) and more unique than using the same email everywhere.
Yeah, thats exactly it, it allows filtering incoming messages into folders based on what I tell a shop and it makes it easier to remember what alias i used where
Only a tiny fraction of people is in a position to do this. If it were really an issue, using the pattern `shopname_n`, where nn is different for every address, should do the trick. It's similar to encrypting serial numbers so they don't [German Tank Problem](https://en.m.wikipedia.org/wiki/German_tank_problem) them.
Wow I have the exact same setup – it works perfectly! I assume you also, like me, have a backup domain like lastname-email.com for all the broken email validators out there?
It's always a cat and mouse game, user+$RANDOM@example.org would still get through and you'd not be able to block that based on the sender (assuming you do it like most people, blacklist-based, rather than allocating new email addresses when you need them).
Of course, this only becomes an issue when the masses start doing it. I'm very surprised how few spammers remove tge +tag, given that that's semi-mainstream by now.
I do prefix+12RandomLetters@blahblah and every potential sender gets it's own random address. Then I use filters to move mail to predefined folders. What's left is spam.
If a mail comes in from an unknown sender to known address I know that the address is compromised.
Ideally I would like to plug my password manager to generate an address and automatically add email filters in place.
Although I was thinking about a service that would just give randomalphanumeric@example.com for all its users, so they would be on the same host and no connection between addresses could be implied. It could or even should be receive only.
The other problem I ran into is spam+sitename@mydomain.com is really awkward to read over the phone. I ended up switching to sitename@email.mydomain.com, which passes all validators and doesn't sound as sketchy. Using a subdomain, I don't seem to catch any of the spam that gets targeted to catchall domain addresses.
Also, I once encountered a site where spam+xyz worked for signup but failed validation on the login form. I think it was something important too, like a utility or bank.
I use qmail, where - has been the extension for, well, since it was created. If you're a postfix person, you can use + or -, with recipient_delimiter.
You're less likely to bump into issues with -.
Some shops don't like their trade name in the email, so rot13 (g? in vim) solves that if your goal is to trace back the leaks. I have not found a reliable way of auto dropping mail from bad sources, sometimes companies change name which makes it hard to validate From with recipient.
> If you're a postfix person, you can use + or -, with recipient_delimiter.
Even better: postfix and dovecot (as of v2.3) now both allow specifying multiple recipient delimiters. So if you run your own mail server you can specify as many recipient delimiters and switch between them if websites are being picky.
I simply changed my mail configuration to use a different character, in my case _ though X would have worked as well.
I wish seive were better supported in mail clients. It works fine on the back end, but I edit my .seive file by logging into the server and sparking up Emacs rather than being able to handle it directly from my mail client.
Odd that you are talking about security breaches with this..
I figured sites wouldn't want to accept it because they know you are most likely filtering their emails so they have a much less chance of getting through to you.
If someone is stealing emails/passwords from a site obviously they will just strip characters after the plus to obtain your normal email address?
But sure, you could have `(my name is)john."..".doe+spam(...)@gmail.com` if you wanted to. Syntactically valid! The parenthesised bits would be stripped out before sending, and I have no idea whether Gmail would be willing to accept the quoted dots bit.
Haha, I debated about throwing in the multi-dot address. Bummed that it was a bad example. :(
As for parens, I recollect the spec lets you nest your parens and quotes! It's insane. e.g. `f(oo."(bar."baz")."quux)@example.com` is valid in the spec.
I wrote an Oracle regex to parse for valid email addresses and I went against the spec rather than what is what's practically used. It was an insane thing.
Periods are handled slightly differently than "+" characters in Gmail -- periods are ignored (so an email to email.spam@gmail would be delivered to emailspam@gmail.com), while everything following a + would be delivered (so email+spam@gmail.com will be delivered to email@gmail.com).
It's been nearly 20 years since I added that feature. I assumed at the time everyone would do it when they saw how handy it is. For some reason that didn't happen...
If the website is breached, the login isn’t a login for any other website, and advertisers have a harder time correlating your identity, and if you get spam you know who is the culprit, and you can stop the spam by deleting the alias.
With this, no need for any other antispam logic. Back to the mid 90s (which is a good thing as far as email traffic is concerned!).
I always do this as well. I knew for months before they announced it that Dropbox had been breached. Yes, they waited so long to announce that the thieves had started using the emails for spam.
The majority of spam [that gets past various RBLs] that I receive is completely ignorant of the dash addressing that I use. It's exactly the same as plus addressing but with a dash instead of a plus.
Pharma spam, 419 scams, password leak crypto blackmail... remember that these miscreants rely on low costs to achieve their profits, so any sort of filtering is too expensive. They don't even filter out abuse@, postmaster@, hostmaster@, or mailer-daemon@.
I run a paid service called Kopi (https://kopi.cloud) that is meant to deal with exactly this issue.
You can use a shared domain:`hackernews@snorremd.kopi.cloud`
Or, after setting up an MX and a TXT DNS record, you can use your own domain: `hackernews@mail.snorremd.com`.
You can change the "real address" of any "forwarder" (`snorremd.kopi.cloud`/`mail.snorremd.com`) to relay to any address you want, whenever you want.
You can block individual addresses like `hackernews@mail.snorremd.com` with two clicks starting from your mail client.
You can also configure individual addresses to redirect to RSS so you can read newsletters or other "chatty" services as part of your normal browsing habits.
Panix.com has a similar feature. If you are dcoder@panix.com, you can use <anytag>@dcoder.users.panix.com, which avoids the problem of places that don't understand "+". I usually use companyname@dcoder.users.panix.com for each company I deal with. (Note, I am not actually "dcoder".)
It's a little longer to read over the phone, but I've never had trouble with it. And I've been able to tell a couple of companies that their email databases had been hacked or stolen.
In that instance you can. What is also nice though is if you have a custom domain, you can set the custom domain to do the same thing AND have an alias.
So for me, I have a few emails in my custom domain:
{firstname}@example.com
market@example.com
(there's others, but it's not relavent to this discussion).
market@example.com just goes straight to spam, as I don't use that email for anything. foo@market.example.com is used for each email instance. It works out extremely well.
I really wish FastMail would add an option to use a minus instead of a plus since most forms properly handle minuses, but many do not properly handle pluses.
It reminds me a gag from the last season of What we do in the shadow. A character puts a toothpick on his lip and suddenly none of the other characters recognise him.
Like if spammers and hackers were not aware of the + notation, and like if it wasn’t trivial to extract the underlying email address by removing anything after the +...
Unless you have an alias that completely obfuscate the underlying email, I just don’t see the point.
I agree. But there are other corner cases where that would be helpful. I’ve worked at a lot of software as a service companies where your email address has to be unique per client for a multi tenant system.
We would create different users for different roles. I would love to be able to use one email address distinguished with a tag.
I use these all the time with my outlook.com account (and Gmail before that). You are right that they don't help with spam. However, they add an extra layer of security because now my logins have both a unique email address and password. Of course, a password manager is mandatory.
I moved all my public emails from first@last.something to first.last@wellknownmailprovider
and then spent a lot of time changing my email address in accounts that I've had a really long time.
Shocked at how badly that went, actually. For certain service providers, I couldn't change my email address and was encouraged to open a new account, which would've meant losing certain records in the old accounts. I couldn't consolidate.
And companies that have different email addresses for their accounts and their mailing lists -- not helpful.
And finally, companies that disable the "update your email address" link in footer of popular email list services, so your only option is to unsubscribe -- good going (not).
There's a long story here, but here's the short take:
Most of my email accounts are public email provider mapped to domains. But anytime I sign-up for something that's not tied only to one of my work endeavors, I use the non-mapped address. So, newsletters, sign-ups, Amazon account, etc. I don't use any mapped domains for those things, as those kind of come-and-go.
I segregate my personal email and my business emails from the @public-email-provider address, which I want to keep away from my other activities. It also puts all those mailing list emails, legal acknowledgements, etc., in one place as much as possible. I can filter and manage those in one place.
I also don't have a strong sense of personal ownership of that stuff. It's like a PO Box, not my house address. I don't check that account for human- initiated communication. That's my personal address (which gets almost zero traffic these days) and my work/business email addresses.
I have a strong aversion to the company behind public email provider. But I set a calendar reminder for a year out so I don't think about it much until then. I have some endeavors that will let me close up various business activities and centralize to one. If/when that's solid, I'll probably consolidate all my income-oriented business accounts and services [and probably somewhere else], but keep the public... as it's just a PO Box.
I understand the appeal of this feature for sorting, but it seems ineffective for things like "figure out who sold my email to the spammers" because everyone knows about it and it's elementary to just trim off everything after the plus sign.
Unless you do some kind of verification and filter email sent to addresses without a valid suffix?
Since I have my own domain, I receive all emails addressed at whatever@domain.com. Of course, different values of "whatever" end up in different directories, and should one of those display an insufficient SNR, it would go straight to /dev/null. This way the "proper" address, i.e., the one that goes to the actual inbox, is not easy to extract.
The hard part is social acceptance. This morning the Whirpool technician was very puzzled by me giving him whirpool@domain.tld as my email, although he accepted my explanations in the end. (I might use more opaque identifiers, but then I would forget about what is what, so for the moment I am trying to stick with this scheme, until it becomes too difficult)
The social acceptance part is truly hard. I recently received a BS trademark cease & desist because i was using the company name in the e-mail address I provided them & was using to communicate with them.
Personally, i've just replaced the recipient_delimiter default value(+) with "." as that is basically impossible to strip out. Ex, firstname.COMPANY@example.net
I do get a lot of weird looks when handing the addresses out in person, but a quick explanation usually works. I just tell them, that if I start receiving spam from one one the addresses, I can just block it and be done with it. They sometimes counter with "but we won't spam you" and I acknowledge that with "but not everyone is so nice as you" or something like that.
ps: you can use multiple delimiters, so grouping is possible with firstname.bills.COMPANY@example.net
I use the "companyname" part of "companyname@mydomain.tld" to express (often very profane) editorial views about the company when their site won't let me sign-up with "companyname@mydomain.tdl". I'm sure nobody ever sees it, but it makes me feel better.
I have the same setup, with not very many different directories (most just comes to my inbox), since my email load is pretty manageable. I find the most spam by far comes from an address checked in to a public git repo, with my actual (public) github email a distant second and everything else pretty much nil.
The only non-public email so far that has resulted in a lot of spam was the one I gave to the animal shelter when I adopted my cat. (I count unsolicited advertisements as spam.)
I also have my own domain and use a similar setup, with some grouping, such as:
home@domain.tld is for anyone and anything dealing with my physical home. Delivery of an appliance, repairs, homeowner's insurance and such. I expect the email volume here to be low except when ordering something.
fly@domain.tld is for any flight reservations. That's pretty convenient, I can find any old tickets or travel details by filtering for this address, and I also know any incoming mail is likely an ad, unless I just bought tickets.
hotel@domain.tld is for all hotel reservations, and is even more convenient. Unlike flights, I never need any emails from hotels except to see that my stay has been confirmed.
And on the rare occasions I expect to need a throwaway email, I'll use somethingrandom@domain.tld and point it to /dev/null after receiving what I needed.
I would agree with this technique, but it’s not possible due to the high number of services that don’t permit “+” in the email address or break because they don’t URI encode it. I have several services I will never be able to unsubscribe from because of the latter—and yes, I tried manually URI encoding it and changing the form fields with dev tools.
Edit: Downvote me all you want, they're still breaking the law… In the US there's the CAN-SPAM act (https://www.ftc.gov/tips-advice/business-center/guidance/can...) and nearly every other country has similar laws. Most of them require one-click unsubscribes to work.
It's still failure to comply even if it's due to negligence/ignorance/incompetence.
How exactly should I go about dealing with Universal Pictures Home Entertainment under the CAN-SPAM Act?
Individuals cannot sue under CAN-SPAM Act and I don't think any state Attorney General is going to bring a suit on my behalf because they didn't accommodate a plus alias.
The technical details as to why they are failing to unsubscribe you does not matter at all. What matters is, you've unsubscribed repeatedly and they are failing to register your intent.
What law requires companies to follow IETF standards?
'+' has no special meaning. The relevant standards only say that senders can't dictate how a system encodes its addresses. No law is in place to compel that behavior. If that were the case I'd love to force ISPs supposedly selling IP services to allow unencumbered use of port 25, residential servers, and transport protocols other than TCP and UDP.
They're not saying that not allowing a + is breaking the law, but unsubscribe links being broken (due to the presence of a + in the email) could be breaking the law, especially if there are no alternative methods to unsubscribe.
I've long held the thought of having a mailbox that receives [everything]@[domain], except certain blacklisted addresses.
As certain addresses get spam and/or I lose interest in the business I gave the address to, I add them to the blacklist.
So far, I'm using AWS SES, which seems to be focused on the sending of marketing emails, and are not fussed on receiving, but includes rudimentary blacklisting. So far, it's zero cost.
SES has rule sets for receiving email. I have one rule that matches all the blocked recipients (addresses at my domain that receive spam), which bounces with 'mailbox does not exist' (then stops rule processing), then another rule after that that puts all mail into an S3 bucket.
Then I have a script that uses the AWS CLI to move all the mail from the bucket to a local dovecot server.
The whole thing is really hacky/experimental at the moment, and I haven't given out any addresses, so all that I receive is spam. But the spam I do receive is very little and quickly adds to the blocked recipients list.
Sending using SES uses the built-in SMTP server functionality at AWS and has very generous limits for one who is not marketing.
I presume the parent means Amazon work mail which AFAIR uses SES to send. Last time I evaluated email services, they didn’t handle catch-all which made that a non-starter for us.
Curiously enough, so far I've only ever observed the reverse happening - spammers somehow ending up stripping off the common prefix and leaving the individual suffix intact.
(Though on the other hand thankfully I'm still not getting much spam anyway and it's only a few addresses that were affected, so I only have a limited amount of data to go by.)
Not really surprising: in the eyes of a naive regex for extracting email addresses from a string, a+b@c.d contains a nicely email-looking substring b@c.d but a@c.d isn't contained at all. Spammer address supply chains aren't usually characterized by the highest levels of sophistication.
The process for sending email /from/ a + address is tricky.
First -- in GMail at least -- you have to explicitly set up a + account as being in your list of "from" accounts and then you have to remember to use it every time you reply!
Not to mention forgetting the email I gave them when resetting passwords sucks, too. "Was that foo+hn or foo+ycombinator or foo+ycombinator.com or foo+hackernews or... hm... uhhh..." (You need a centralized password manager, in other words.)
I've had several issues where I've replied and sending from the base-address means the conversation goes awry ("We don't recognize this email address"), or at best I still expose the base address because I only remember to reply using the laboriously-created-from-plus address about a fourth of the time.
I honestly don't see how that would work. Like, how would you unsubscribe to a mailing list? Most these days let you click a link rather than reply with "unsubscribe" but still...
I've had multiple occasions where contact /to/ a business needed to come from the email address I used to sign up with their service (automatic correlation to users I guess).
One particular exchange was particularly painful. Every email I sent was, I assume, routed to a new customer queue. Every email that I sent from my non-+ alias was delayed by days and then dealt with by an unhelpful "we don't recognize this email address".
It was very painful and it was all because I used a + alias as my supplied email address but kept forgetting to use it as my 'from' address.
Had I not had the ability to set it as my 'from' I'd probably have stopped using + aliases entirely.
Exchange was originally an X.400-based groupware system, SMTP support was somewhat of an afterthought. Exchange has a long history of not implementing SMTP properly with protocol violations and proprietary payloads (TNEF) and headers (e.g. Thread-Index)
I've been using "Microsoft 365" since 2012, outlook w/ a custom domain and all the grandfathered features. The +tag has always been supported, and I can't really tell what the difference between "Office 365" and "Microsoft 365" is, since the latter appears to include the former, if not identical.
Microsoft recently renamed a majority of their products yet again because if it wasn't confusing enough already, it's even more confusing now!
"Microsoft 365" now includes all of Windows 10, Office 365 (Office on PC) and Azure. This is more geared towards the home market.
Then, there's "Office 365 for Business" which as the name implies is more for business/corporate customers.
It looks like your custom domain is using the old Outlook.com/Hotmail architecture, which already supported +<tags> in email addresses - while Microsoft's corporate offering (running on a cloud based Exchange Server) still doesn't, and they're pushing support for it out later this year.
No it hasn’t. RFC 822 essentially says “local-part is whatever you want it to be” and defines no semantics. Certainly it doesn’t say “you can put a plus on and anything after that will go to the same mailbox”. That’s a far more modern notion, and one that is far from ubiquitous. Rather, it says things like this:
> The local-part of an addr-spec in a mailbox specification (i.e., the host's name for the mailbox) is understood to be whatever the receiving mail protocol server allows. For example, some systems do not understand mailbox references of the form "P. D. Q. Bach", but others do.
1982? Back then Microsoft's attitude toward the Internet was "embrace, extend, and suffocate." It made little sense for them to work with the nuances of standards, according their business model back then.
I have added this capability to every commercial web property I've worked on.
> I have added this capability to every commercial web property I've worked on.
I tried doing email validation the modern way: if '@' in emailfield then return True else 'email address needs an @'. The user gets a confirmation email anyway, and the sign-up process was literally name, email, tick a box that you read the privacy policy, and click continue, so they can just re-do that if they typo'd the address.
Iirc the boss decided to set requirements for a regex that I was to implement instead. Or maybe he made the regex and I tweaked it saying "this won't match .amsterdam domains", not sure anymore.
I think if you have the means, you should always get a custom domain for your email address. Your email address is the key to your online identity. You should own it, and not lease it from someone else.
And it is not like you have to manage your own email servers. You can use services like fastmail or any number of email providers to receive email on your own domain. You also have the ability to change your implementation without changing your address. You can decide to host it yourself, or go to another provider without having to tell all your contacts that you are changing your email.
It becomes trivial to actually give out email addresses that are customized for the service. Instead of me+service@hotmail.com you can give out service@mydomain.com.
In my opinion, the money you spend for your own domain for email, is well worth it.
I wonder why there are no email providers that offer an infinite number of aliases that cannot be associated with the primary address. Simply offering any aliases would soon fill out easy-to-remember addresses, but can't email providers offer a feature to add a randomly-generated address such as 098f6bcd4621d373cade4e832627b4f6@email.provider? This way, users can use a different email address on a different web service when registration, which would reveal no information about the user and drastically improve users' privacy. In addition, it is easy to track down which web service is at fault in the event of receiving spams via sold user data.
I don't think it is the only reason. Labels in Gmail are still really nice. Microsoft Outlook rules will often duplicate messages and smart folders using search filters don't work between browser and email client. Using IMAP they are simply virtual directories like they should be.
Microsoft Calendar is also pretty bad too. Like in a large organization you'll often have people leave the company. When you delete a series in Outlook with multiple people it tries removing the history for everyone which is important dates. There are a lot of nuances that would prevent me from ever switching to Office. Even OneDrive is tied to SharePoint and it is way too easy to break.
