Gmail plus addressing and dots: how one inbox becomes many signups

Gmail delivers [email protected], [email protected] and [email protected] to the same inbox as [email protected]. People use this to sort their mail, and some use it to claim the same free trial or referral bonus many times. To catch repeats, compare a normalized key: lowercase the address, drop the plus tag, and for Gmail remove the dots and treat googlemail.com as gmail.com.

#How does Gmail plus addressing work?

You add a plus sign and a word after the username, and the mail still arrives. Google's own example from 2008: mail to [email protected] reaches [email protected] (Official Gmail Blog, March 5, 2008).

The practice has a standard name, subaddressing. RFC 5233 describes it as adding "detail" to an address after a separator such as "+". A Gmail username can never contain a plus sign, so whatever follows one is always a tag (Google Gmail Help).

#Why do dots not matter in Gmail addresses?

Gmail ignores dots in the username. Google tells the owner of [email protected] that "you own all dotted versions of your address". Nobody else can register a dotted copy, because Gmail reports the username as taken (Google Gmail Help).

The second domain works the same way: "Messages sent to @gmail.com and @googlemail.com are the same" (Google Gmail Help). The rule stops at Google's consumer domains, though. For Gmail through a company or school domain, Google says "dots do change your address".

#How many signups can one inbox make?

With plus tags there is no limit. With dots alone, the count doubles with every letter. A dot can sit in each gap between two letters, but never at the start, at the end or twice in a row (RFC 5322). We counted every form by brute force for usernames of 6 to 12 letters:

At Gmail's longest username of 30 characters, the dots alone give 536,870,912 forms. On October 23, 2026, Google's results for "gmail dots trick free trial" held three tools that print every dotted form of an address. A forum thread on reusing one address this way sat at the top.

Google cannot stop it on its side. Its help page says it "can't prevent people from accidentally or maliciously using a dotted version of your address to sign up" (Google Gmail Help).

#Which other email providers allow the same?

Each row comes from the provider's own help pages, read on October 23, 2026. Microsoft's Exchange Online tries the full address first and then retries it "without the plus sign". We found no current Microsoft page for consumer Outlook.com accounts, so it is left out.

#How do you normalize emails at signup?

Keep two values for each account: the address the person typed, for sending, and a key for finding repeats. Build the key in three steps:

1. Trim spaces and lowercase the address. RFC 5321 lets a server treat case in the local part as meaningful, but says relying on it "impedes interoperability and is discouraged".
2. Cut the local part at the first plus sign.
3. For gmail.com and googlemail.com only, remove the dots and use gmail.com as the domain.

// A key for spotting repeat signups. Store it next to the address; send mail to the original.
export function emailKey(raw) {
  const email = raw.trim().toLowerCase();
  const at = email.lastIndexOf("@");
  if (at < 1 || at === email.length - 1) return null;
  let local = email.slice(0, at);
  let domain = email.slice(at + 1);
  const plus = local.indexOf("+");
  if (plus > 0) local = local.slice(0, plus); // drop the +tag on every domain
  if (domain === "googlemail.com") domain = "gmail.com";
  if (domain === "gmail.com") local = local.replaceAll(".", ""); // dots only matter elsewhere
  return `${local}@${domain}`;
}

We ran both on October 23, 2026, with the same inputs and the same results. The three Gmail forms became one key, and dots on other domains stayed. Gmail allows no dash in a username, so the Gmail test addresses belong to nobody.

[email protected]    -> [email protected]
[email protected]           -> [email protected]
[email protected]         -> [email protected]
[email protected]                  -> [email protected]
[email protected]                       -> [email protected]
[email protected]                        -> [email protected]
not-an-email                                 -> null

Then make the key unique in your database, so a second account for the same inbox fails when it is saved. In SQLite 3.45, the second signup was refused:

CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT NOT NULL, email_key TEXT NOT NULL);
CREATE UNIQUE INDEX users_email_key ON users (email_key);

created [email protected]
refused [email protected] -> UNIQUE constraint failed: users.email_key

Never send mail to the key. Outside gmail.com, a dot can be part of a real address, so two keys that look alike may belong to different people.

#What does normalization not catch?

• Fastmail's subdomain addresses and Yahoo's nickname addresses, which do not use a plus sign.
• Alias services such as Apple's Hide My Email, which hand out unrelated random addresses (what privaterelay.appleid.com is).
• Throwaway inboxes, which an email check catches instead (how to stop fake signups).
• A person with two real inboxes. For that, compare other signals, such as the IP address.

An email reputation check will not flag these forms either, and it should not. FFraud's API returned email_type: normal for a tagged Gmail address and for a dotted googlemail.com address on October 23, 2026. Each is a real, deliverable form of one inbox, so catching the repeat is the site's job (email docs).

#Questions people ask