Email Aliases and Plus Addressing: Stop Spam Before It Starts

Email Aliases and Plus Addressing: Stop Spam Before It Starts

Most inbox advice is reactive. Something unwanted arrives, and you decide what to do with it. Aliases are the one technique that works in the other direction: they change what happens before the mail is sent, by controlling which address a given company holds in the first place.

The mechanism is old, free, and requires no setup at all. It is also widely misunderstood - people either dismiss it as a party trick or expect it to stop spam outright, and neither is right. Here is what it actually does, where the limits are, and how to use it in a way that survives contact with reality.

What Plus Addressing Is

Everything between a plus sign and the at sign in an email address is a routing tag. Mail servers that support the convention ignore it when deciding where to deliver.

So if your address is you@gmail.com, then all of these arrive in the same inbox:

• you+shop@gmail.com
• you+conference2026@gmail.com
• you+that-newsletter@gmail.com

You do not create these addresses. You do not configure them. There is no list of valid tags anywhere. You invent one at the moment you type it into a signup form, and it works immediately, forever, for free.

The technical name is subaddressing. Gmail supports it, as do Outlook, Fastmail, Proton, iCloud, and essentially every self-hosted mail server. The critical detail - and the one that makes the whole technique useful - is that the tag is preserved in the message headers. Delivery ignores it, but the To: header still reads you+shop@gmail.com. That is what your filters can see.

The Three Things It Actually Buys You

Plus addressing does not reduce your mail volume by a single message. Everything sent to a tagged address is delivered exactly as it would have been. What changes is what you can do with it.

1. Filtering that survives domain rotation

This is the most practical benefit and the least discussed.

Almost every Gmail filter people write keys on the sender: block this address, label mail from that domain. Sender-based filters have a structural weakness - the sender controls the sender. A company that gets acquired starts mailing from a new domain. A newsletter migrates providers and the envelope changes. An outbound campaign rotates through twelve domains a quarter on purpose. Every one of those events silently breaks your filter, and you find out weeks later when the mail is back in your inbox.

A filter keyed on the recipient has the opposite property. You control the address you gave out, and no sender can change it. A filter matching to:you+events@gmail.com keeps working no matter how many times the sender re-platforms, rebrands, or rotates domains, because the thing being matched is on your side of the transaction.

2. Attribution when something leaks

Give a distinct tag to each company and your address becomes an audit trail.

When unrelated cold outreach starts arriving at you+webinar-march@gmail.com, you have not merely received spam - you have received proof of exactly which registration form sold, shared, or leaked your data. There is no other way to get that information. Without tags, an address that appears on a broker list is untraceable; with tags, the leak identifies itself on arrival.

This changes what you can do about it, too. Instead of tightening filters globally, you retire one tag. Everything addressed to it gets archived or dropped, and every other context you use is completely unaffected.

3. Clean separation without extra accounts

The obvious use, and still a good one. A handful of tags cleanly partitions the categories of mail that otherwise blend together:

| Tag | Use it for | Filter action | |---|---|---| | +shop | E-commerce accounts, order confirmations, receipts | Label, skip inbox | | +events | Conference registrations, webinars, gated downloads | Label, skip inbox | | +news | Newsletters you deliberately want | Label, skip inbox | | +trials | Free trials and product signups you may abandon | Label, skip inbox | | +fin | Bank, accountant, invoices | Label, never send to spam, keep in inbox |

The +fin row is the one people skip and then regret. A tag reserved for genuinely important mail, combined with a Never send it to Spam filter, is one of the few reliable ways to guarantee that a critical message is never misclassified.

How to Set It Up in Gmail

Ten minutes, once.

Step 1 - Choose a small set of tags. Five or six, short, obvious. The failure mode here is inventing a unique tag for every site and then losing track; the second failure mode is using one tag for everything, which gains you nothing. Category-level tags are the practical middle, with per-company tags reserved for services you actively suspect.

Step 2 - Use the tagged address at signup. Type it into the form exactly as you would a normal address. Nothing else is required.

Step 3 - Create the filter. In Gmail, open Settings -> Filters and Blocked Addresses -> Create a new filter. Put the tagged address in the To field - not the From field - and choose Create filter. Then select Skip the Inbox and Apply the label, creating a label named for the tag.

Step 4 - Apply it retroactively. Tick Also apply filter to matching conversations before saving, so existing mail sorts itself immediately rather than only affecting future messages.

Step 5 - Protect the important tag. For your +fin-style tag, create a filter with Never send it to Spam ticked and no Skip the Inbox. That mail should interrupt you; that is the whole point of it having its own tag.

For more filter patterns, including combining recipient matching with other conditions, see our Gmail filter examples. If you are creating several labels, our label naming conventions guide will save you a reorganization later.

The Dot Trick and Why It Is Weaker

Gmail also ignores dots in the local part of an address. johnsmith@gmail.com, john.smith@gmail.com, and j.o.h.n.smith@gmail.com all deliver to the same mailbox.

This gives you a second family of variations, and it has exactly one advantage over plus addressing: no signup form has ever rejected a dot. When a site refuses the plus sign, a dot variation gets through.

Everything else about it is worse.

Dots carry no meaning. john.smith@gmail.com does not tell you it was the one you gave to a particular retailer three years ago - you would have to keep an external record, which nobody does. The variations are also finite and predictable rather than unlimited and arbitrary. And because dot-insensitivity is a Gmail-specific behavior rather than a general standard, it does not transfer if you ever move providers.

Use dots as a fallback for sites with broken validation. Use plus tags for everything else.

Where Plus Addressing Breaks

Being honest about the failure modes is what separates a useful technique from a superstition.

Tags get stripped. Removing everything between the plus and the at sign is a trivial normalization, and any competent data broker does it - partly to deduplicate records, partly because a tagged address is a visible signal that the recipient is technically sophisticated. This means plus addressing reliably catches careless leaks and legitimate list sharing, but it does not defeat a determined operator. If your address ends up in an enrichment database, it will be the bare form.

Signup forms reject the plus sign. Common enough to be a real friction point, and there is no fix beyond using a different technique for that site.

Some senders mangle the reply path. Occasionally a poorly built system uses the tagged address in a way that breaks replies or account recovery. Rare, but a reason not to use tags for accounts where losing access would be serious.

Tags advertise the technique. A person reading you+acme@gmail.com can see immediately both that you are tagging and what your real address is. Against a human operator rather than an automated pipeline, this offers no concealment whatsoever.

Stronger Alternatives When It Is Not Enough

Two options give you what plus addressing cannot.

Email relay services (Apple's Hide My Email, Firefox Relay, SimpleLogin, DuckDuckGo Email Protection) generate a unique, random address per site that forwards to your real mailbox. Nothing about the generated address reveals your real one, so stripping is not possible. Each address can be switched off individually, which cuts the mail off at the relay rather than filtering it after arrival. The costs are a dependency on the relay provider, occasional deliverability friction, and complications when replying.

A custom domain gives you the strongest position. Distinct addresses on your own domain are genuinely separate, permanently retirable, and unconnected to any shared mailbox identifier. You also keep your address if you ever change providers, which is the underrated benefit.

One important caveat if you take the custom domain route: do not configure it as a catch-all. A catch-all accepts mail to every possible address at your domain, which means the address verification step that lead databases run always succeeds, so every guessed address gets written into the database and sold. Define the addresses you actually use and let the rest bounce. We cover this and the other triggers behind a volume spike in why am I suddenly getting so much spam.

What Aliases Cannot Do

Aliases are a routing technique. They decide where mail goes and where it came from. They have no opinion about whether you wanted it.

That distinction becomes sharp with cold sales outreach, which is the mail most professionals actually want gone. Consider how outreach reaches you: a lead database derives your work address from your public professional profile by guessing your employer's format and verifying which guess is deliverable. Every part of that process produces the bare address. You never typed it into a form, so there was no opportunity to tag it. The address that a hundred outbound campaigns are working from is the one on your business card and your email signature, not you+something@gmail.com.

So the mail that aliases handle best - newsletters, receipts, event follow-ups, trial nurture sequences - is the mail you at some point opted into. The mail you never opted into arrives at the untagged address, from a domain registered last month, written by a language model, personalized enough to look like a genuine note from someone who read your profile. There is no tag to filter on, no stable domain to block, and no repeated phrase to match.

Catching that requires looking at the message rather than the address: is this a first contact from an unknown sender, is there a sales ask, does the sending infrastructure carry automation fingerprints, has this person ever been part of a real thread with you. Email Ferret scores every incoming message on those behavioral signals, so a campaign that rotates domains weekly is flagged on every domain it uses. Your allowlist always takes precedence, and flagged mail is labeled rather than deleted - which pairs naturally with the tagging system above, since both end up as labels you can audit.

Use aliases for what they are excellent at: containing the mail you invited, and proving who leaked you. Use behavioral filtering for the mail you did not invite.

FAQs

What is Gmail plus addressing?

Anything between a plus sign and the at sign in your address is treated as a routing tag and ignored for delivery, so you+anything@gmail.com lands in you@gmail.com. No setup or extra account is required - you invent the tag when you type it. Gmail preserves the full tagged address in the message headers, which is what makes filters able to match it.

Does plus addressing actually stop spam?

No. It contains and traces spam rather than preventing it. Every message sent to a tagged address is still delivered. What you gain is a filter that cannot be broken by the sender changing domains, and definitive proof of which signup leaked your address when unrelated mail starts arriving at a tag.

Can spammers just remove the plus tag?

Yes, and serious data brokers do - stripping the tag is a one-line normalization. Plus addressing reliably catches careless leaks and legitimate list sharing, but it will not defeat a determined operator. Use a relay service or a custom domain when that matters.

Why do some websites reject plus signs in email addresses?

Because their validation is written incorrectly. The plus character is explicitly valid in the local part of an email address. There is no fix on your end other than using a dot variation or a relay address for that site.

What is the Gmail dot trick?

Gmail ignores dots in the local part, so johnsmith@gmail.com and john.smith@gmail.com are the same mailbox. It is useful as a fallback when a form rejects the plus sign, but dots carry no meaning, so you cannot tell which variation you gave to which company without keeping a separate record.

Should I use aliases or a custom domain?

Plus addressing is free and instant, which makes it right for most people. A custom domain gives genuinely distinct addresses that cannot be traced back by stripping a tag, permanent retirement of any address, and portability between providers - at the cost of setup and an ongoing fee. If you do use a custom domain, avoid a catch-all configuration.

Key Takeaways

1. 1.Plus addressing gives you unlimited tagged addresses with zero setup, and Gmail keeps the full tagged address in the headers so filters can match it
2. 2.The real value is diagnostic — when cold outreach arrives at a tag, you know precisely which signup sold or leaked your address
3. 3.Tags can be stripped by any competent data broker, so plus addressing traces careless leaks but does not defeat a determined operator
4. 4.Filter on the To field rather than the From field, which is the one filter pattern that survives senders rotating their domains
5. 5.Aliases contain and route mail but never reduce what arrives; they are a complement to filtering, not a substitute for it

Related Topics

• Gmail Filter Examples

  Ready-made filter recipes, including To-field matching

• Allowlist and Blocklist Setup

  Protect important senders before you filter aggressively

• Why Am I Suddenly Getting So Much Spam?

  The nine triggers behind a sudden volume spike

• Gmail Filters and Labels Guide

  The complete guide to filtering mail in Gmail