What is plus addressing?
Plus addressing, also called sub-addressing, is the convention where anything after a plus
sign in an email address is ignored when the mail is delivered. Mail to
name+anything@domain.com arrives in the inbox at name@domain.com.
One inbox, an unlimited supply of addresses that look different to any system storing them.
What it is legitimately for
Plus addressing is genuinely useful, and plenty of careful people use it exactly as intended.
An address such as name+vendor@domain.com makes that vendor's mail easy to filter.
If the same address later appears in a spam campaign or breach dump, it also reveals where the
leak began. The convention is standardized as sub-addressing in
RFC 5233,
which is why support is so widespread. This is good hygiene, often practiced by your more
thoughtful users. Treating it as suspicious by default is a mistake.
How it gets abused
The same feature that makes filtering easy can make one inbox look like a crowd. A product
offering one free trial per email address may, in practice, offer one trial per plus suffix,
which is to say an unlimited number. The connoisseur of the free tier works through
name+jan@, name+feb@, and onward with the date helpfully embedded,
treating your product as a zero-priced subscription with a monthly chore of re-registration.
The trick sits behind a good deal of
trialmaxxing and
free trial abuse, and it costs the practitioner
nothing at all.
Normalization, not blocking
The right response is to resolve addresses to a canonical form, not refuse them. Strip the plus
suffix, apply any provider-specific rules, and compare the result with existing accounts. The
provider-specific part matters more than it looks: Gmail also ignores dots in the local part, so
john.smith@gmail.com and johnsmith@gmail.com reach one mailbox, and a
normalizer handling only the plus sign will miss that pair entirely. Signups differing only by
suffix then resolve to the single inbox they always shared. You get the useful signal without
turning away legitimate users who merely wanted to organize their mail.
Dregs normalizes addresses as part of identity resolution, so plus-suffix variants of one inbox link to each other in the identity graph and contribute to the Authenticity score alongside device history, name plausibility, and behavior. Because the signal is weighed rather than decisive, a single plus address on an otherwise ordinary account is not treated as a problem. This keeps false positives away from people using the feature properly. When several accounts resolve to one inbox, the link opens into the evidence so you can see exactly why they were joined.
Frequently Asked Questions
Q: Should I block plus addressing at signup?
A: Generally no. A hard block produces false positives against a large population of entirely legitimate, often quite technical users who rely on the convention to organize their mail, and it is trivially sidestepped anyway by anyone who moves to a different free address or a disposable one. Normalizing and counting is the better move: accept the address, resolve it to its canonical form, and treat several signups sharing one canonical inbox as a signal to weigh rather than a wall to hit.
Q: Which providers support plus addressing?
A: Gmail and Google Workspace, Outlook and Microsoft 365, Fastmail, Proton, iCloud, and most modern mail servers, including the common self-hosted ones. Support is widespread enough to assume it is present unless you know otherwise. A few providers use a different separator or offer full alias systems instead, so normalization that only handles the plus sign will miss some equivalent addresses.
Q: Is plus addressing the same as a disposable email address?
A: No, and the difference matters for how you treat each. A disposable address belongs to a throwaway inbox on somebody else's domain, and the person behind it is unreachable within minutes. A plus address belongs to a real, durable inbox that its owner checks and intends to keep. Someone signing up with a plus address has given you a working way to reach them, which is more than a disposable address does.
Further Reading
Detect repeat signups behind plus-addressed emails.
Dregs helps you detect repeat signups that use plus-addressed emails to claim another free trial. It resolves address variants to the inbox behind them and weighs that link alongside device and behavior without blocking legitimate users.
Schedule a Demo