Plus addressing: what you+tag@ hides, and what it doesn’t

What a plus tag actually is

An address has two halves: the local part before the @ and the domain after it. Plus addressing — subaddressing, to use the word the standards use — splits the local part again, at the first +. Everything to the left of it is the mailbox. Everything to the right is a label that the receiving server is expected to ignore when it decides where to put the message.

One mailbox, any number of theseyou+shop@example.comCopy

So you+shop@example.com, you+news@example.com and you@example.com are one mailbox under three names, and the message lands with the tag still visible in its To: header. That is exactly what makes a tag useful for filing, and exactly what makes it useless for hiding.

Which providers accept a tag, and which do not

Read from each provider’s own documentation on 5 September 2026. This is the kind of table that goes out of date quietly, so the thirty-second test at the end of this section is worth running before you trust any row of it with something that matters.

The pattern in that table is worth naming. Every provider on it will give you tags; the three that offer something better offer a different address rather than a decorated one.

The three jobs a tag does well

None of what follows is a reason to stop using plus tags. Inside your own mailbox, on mail you already agreed to receive, they are the cheapest organisation there is: nothing to configure, nothing to pay for, no second account to remember the password to.

Filing without a rule per sender

One filter on the tag beats twenty filters on twenty From: addresses. Mail to you+bank@ goes to the right folder whatever the bank’s marketing department decides to rename itself to this year.

Catching a careless leak

Give every sign-up its own tag and the first unsolicited message names the party that let go of your address. It catches carelessness — a breach, a list sold in a hurry, a badly configured export — and, as the next section explains, not a great deal else.

Test accounts, up to a point

A tag per test run gives a suite as many addresses as it wants with one mailbox behind them, for as long as the application under test accepts them. When it does not — and a fair number deliberately do not — a catch-all domain does the same job without asking anybody’s permission.

All three have one property in common: they are for mail you want. The moment the goal becomes mail you do not want, a tag stops being the tool for it.

The four things a tag cannot do

A plus tag is a label on the outside of an envelope that still has your name on it. Everything below follows from that one sentence.

• It does not hide your address. you+shop@example.com contains you@example.com in plain sight — in the headers, in every export, in every database the message passes through on its way to you.
• It cannot be switched off. There is no such thing as revoking a tag. Mail addressed to it is delivered to your mailbox whatever you do, and the best you can manage afterwards is a rule that files it out of sight once it has already arrived.
• It does not survive a sender who normalises. Cutting the tag off is the one-liner below, and reducing an address to its canonical form before storing it is ordinary engineering practice — done for deduplication rather than for malice, which is exactly why it is done so widely.
• It is not accepted everywhere you will need it. A tag that a sign-up form takes may still be refused by the same site’s sign-in page, by its password reset, or by the payment processor behind it — and by then the account is the one with the tag in it.

// Everything a plus tag protects you from, undone.
const canonical = address.replace(/\+[^@]*/, '');
// "you+shop@example.com"  ->  "you@example.com"

Three lines including the comments, and something very like it lives in every address-validation library you have ever installed. Whether a given site runs it is a coin toss you do not get to watch.

Why so many forms refuse the plus sign

The character is legal. RFC 5321 allows + in a local part with no quoting of any kind, and an address containing one is as valid as an address containing a letter. Forms reject it anyway, for three reasons worth telling apart, because each calls for a different answer.

• A regular expression written from memory. Somebody allowed letters, digits, a dot, a hyphen and an underscore, and stopped there. This is a plain bug, and the site almost certainly does not know it has it.
• A deliberate policy. The site knows exactly what a tag is and does not want one account per tag — free trials, referral bonuses, one vote per person. Blocking the character is the crudest way to enforce that, and the one that takes an afternoon.
• Something further down the line. The form accepts it and a CRM, a billing system or a delivery provider behind it does not. This is the one that fails late, usually at the receipt.

Which of the three you have run into is usually visible from where it broke.

A refusal aimed at the domain rather than at the local part is a different problem with a different set of answers, and why sign-up forms block disposable email covers that one from end to end.

What to use when the address itself has to be different

Three tools change the address instead of decorating it. They differ in who ends up reading the mail, and in practice that is the only axis worth comparing them on.

A domain you own, in one record

Point the domain’s MX at this service and every local part on it becomes an inbox: shop@yourdomain.com, bank@yourdomain.com, one per sign-up, and not one of them containing any of the others. Burn one and the rest are untouched, because there is no base address for them to share.

The one record to add10 smtp.grabmail.ioCopy

It is free and there is no account to open — but be clear about what it is and is not. Anybody who knows one of those addresses can read it, exactly as on the public domains, and messages are deleted after 5 days. That makes it right for sign-ups, coupons and test accounts, and wrong for anything you would mind a stranger reading. The full walkthrough is ten minutes, most of it spent waiting for DNS.

A relay alias

A relay gives you an address on somebody else’s domain that forwards into the mailbox you already use, plus a switch to turn it off. You keep your provider and your filters; the sender never sees anything of yours. The trade is that the relay learns every correspondent you have, and that its domains keep turning up on the same blocklists as everything else. Burner, alias or temp mail sets the three side by side.

A temporary address

When it is an account you would not mind losing — a download, a coupon, a forum you will read once — the simplest answer is an address with nothing behind it at all. Open one on grabmail.io or on any of the other 8 public domains, read the confirmation, and let it expire on its own. How to use one properly includes the two cases where you should not.

There is a fourth shape worth knowing, because it is the one thing on this page that behaves like a tag and cannot be stripped like one: every mailbox here also has an alias, a second address that delivers into it and reads back empty. You give the alias to the form and keep the address for yourself.

A rule for the next form

Four questions, in this order. The first one that gets a yes is your answer.

1. Would you mind losing this account? If not, use a temporary address and stop reading here.
2. Do you own a domain? Then invent a fresh local part on it. It is the only option on this page that is permanent and disposable at the same time.
3. Will you need to reply from it, or recover it in two years? Then it has to be a relay alias or a real second mailbox, and not a tag.
4. Is this mail you already want, from a sender you already trust? Then a plus tag is exactly the right tool, and not one of the objections above applies.

The short version

• A plus tag files mail. It does not hide anything, and it cannot be revoked.
• Gmail, Outlook.com, Proton Mail, Fastmail, iCloud Mail and Zoho Mail accept one. Yahoo Mail does not. On a work address, ask whoever runs it.
• Assume any site can remove the tag, and that the ones you would most like to catch already have.
• When a form refuses the +, do not fight it. The character is legal and the site is not going to be fixed this afternoon.
• For an address that is genuinely different, use a catch-all on a domain you own, a relay alias, or a temporary address.

And if only one line survives the read: a tag is a label on your address, not a mask over it.

Questions