Mastodon Mastodon Mastodon Mastodon

Email Plus and Plus Addressing: A Great Tool for Personal Data Protection

Photo of author

Kamil Akbari

Published:

Last updated:

Email plus addressing, also known as subaddressing or tag addressing, is a technique that lets you create variations of your email address without registering a new account. It is a practical and underused tool for tracking data leaks, filtering inbox clutter, and improving your digital privacy.

What Is Email Plus Addressing (Subaddressing)?

Plus addressing works by appending a + sign and any label to the local part of your email address — the portion before the @ symbol. For example, if your address is [email protected], you can use [email protected] or [email protected]. All messages sent to these variants are delivered to your main inbox. The technique is defined in RFC 5321 (SMTP) and formally specified for filtering in RFC 5233; it is officially supported by Gmail, Outlook/Hotmail, ProtonMail, Fastmail, and most modern mail providers. Some older or poorly configured services may reject addresses containing a + sign, which is the main limitation.

The method is also referred to as “email tagging” and “subaddressing.” Plus addressing and tag addressing are the most widely used terms in English-language documentation.

How to Use Plus Addressing for Data Leak Detection

The most powerful privacy use case is tracking which companies sell or leak your email address. The process is straightforward:

  • When registering on a new website, enter your address in the format [email protected] — for example, [email protected] for Amazon.
  • Confirm registration and proceed as normal.
  • If you later receive spam or marketing email addressed to [email protected] from a sender unrelated to Amazon, you have identified a data breach or data sale by that service.

This approach provides concrete evidence of which specific service exposed your address, which is difficult to prove with a single shared email address.

Organizing Your Inbox with Gmail and Outlook Filters

Plus addresses integrate directly with email filtering rules, enabling automatic inbox organization:

  • In Gmail: navigate to Settings → Filters and Blocked Addresses → Create a new filter. Set the “To” field to [email protected] and apply a label or skip the inbox.
  • In Outlook: go to Settings → Mail → Rules → Add new rule. Filter on “To” contains your plus address and move matching messages to a folder.
  • In Proton Mail: Settings → Filters → Add filter condition on recipient address.

Security Applications: Strengthening Account Isolation

Beyond inbox organization, plus addressing provides meaningful security benefits. Using a unique plus address for each service means that if a credential database is leaked and scraped, the email address in the breach is service-specific and immediately identifiable. This does not prevent credential stuffing attacks on its own, but it narrows the blast radius and accelerates incident response. Combined with a password manager and unique passwords per site, plus addressing forms part of a solid account hygiene strategy aligned with NIST SP 800-63B guidelines on digital identity.

Editorial note (2026): Since 2023, several major services — including some travel booking platforms and e-commerce sites — have begun stripping the +label portion of email addresses at registration, which defeats the tracking benefit. If a site strips your label, consider using a Hide My Email alias (Apple) or a dedicated alias service like SimpleLogin for stronger isolation.

Use Cases for Developers and QA Teams

Development and QA teams frequently rely on plus addressing to create multiple test accounts on a single service without needing separate email inboxes. For example, [email protected] through [email protected] can all be managed from one inbox. This significantly speeds up user flow testing, onboarding validation, and email template verification. However, developers should be aware that plus addressing can be stripped by input sanitization that incorrectly treats the + as a URL-encoded space character — a common bug in web forms.

Marketing and Campaign Tracking

Marketers can assign unique plus addresses to different campaign channels — [email protected], [email protected] — to measure inbound lead sources without UTM parameters. This provides a simple, low-overhead attribution mechanism that works independently of analytics tooling.

Limitations and When to Use Aliases Instead

Plus addressing has three significant limitations worth understanding:

  • Strippable by services: some sites remove the +label at registration, either intentionally or due to buggy validation.
  • Your base address is still visible: anyone who receives or intercepts the full plus address can see your primary email address. It provides tracking, not anonymity.
  • Not universally supported: some older mail servers, corporate gateways, or CRM systems reject + addresses as invalid.

For situations requiring true anonymity — whistleblowing, sensitive registrations, or services known to strip labels — consider a dedicated alias service (SimpleLogin, AnonAddy) or Apple’s Hide My Email, which generates randomized addresses that forward to your inbox without revealing your real address.


Kamil Akbari

Kamil Akbari is a cybersecurity editor and author at CyberSecureFox with more than 5 years of experience in cybersecurity software development and security tooling. He focuses on AI security, CVE analysis, ransomware, malware, cloud security, and practical pentesting. His articles are based on official advisories, CVE/NVD data, CISA alerts, vendor publications, and public research reports.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.