What is plus addressing?

People use the tag to sort incoming mail and to find out who leaked their address. A message to you+acme@ from anyone other than Acme is evidence that Acme sold or lost the list.

Gmail, Outlook.com, Fastmail and iCloud all support it. Yahoo uses a hyphen instead of a plus, and plenty of smaller hosts support neither, so it cannot be assumed.

For deduplication the tag is noise and should be stripped for matching. For sending it is essential and must be preserved, since the user built a filter on it.

Fraud checks sometimes strip tags to catch one person opening several free trials. That is a defensible use of the same normalization, provided you still deliver to the address as given.

Say Priya signs up as priya+shop@gmail.com. Your welcome email has an unsubscribe link built by pasting her address into the URL: https://acme.example/unsub?email=priya+shop@gmail.com. A month later she decides she's had enough and clicks it.

In a URL query string, a plus sign means a space. Your server decodes the parameter as priya shop@gmail.com and finds no such subscriber. It shows an error or, worse, a cheerful confirmation that did nothing. Priya keeps getting mail, and her next move is the spam button.

The fix is to percent-encode the address so the plus becomes %2B, or better, to put an opaque token in the link and no address at all. You can test this in ten minutes: sign up with a tagged address, then try every flow that carries the email in a link: confirmation, password reset, unsubscribe, and the preference page.

While you're there, check the signup form's validation pattern. Plenty of hand-written regular expressions allow letters, digits, dots and hyphens in the local part and forget the plus.

On Gmail the tag always works, which leads people to assume it works everywhere. Whether a given business domain accepts tagged mail depends on how its mail server is set up. Postfix controls it with a setting called recipient_delimiter. An administrator can turn it on, leave it off, or choose a different character.

In practice that means sam@acme.example can be a working mailbox while sam+news@acme.example is rejected with a 550, because the server doesn't strip tags before looking up the user. Verifying the base address and assuming the tagged one works would give you a wrong answer.

Yahoo's hyphen scheme is odder still. Its disposable addresses are built from a separate base name the user picks, which isn't their account name, so you can't derive the main address from one. For matching purposes, treat a Yahoo address with a hyphen as just what it is: a distinct address.