Gmail plus addressing lets you add +anything to your address before the @ sign. Mail sent to [email protected] arrives in [email protected] with no setup and no limit on how many tags you invent. The tag is a label you can filter on, and it tells you which company leaked your address.
That's the whole feature. What follows is how to make it useful, and the four specific ways it stops working, because the top result on Google for this right now is a support-forum thread from someone reporting exactly that.
How Gmail plus addressing works
Take your address. Put a + and any text after the username, before the @:
[email protected]becomes[email protected]- or
[email protected] - or
[email protected]
All of it lands in [email protected]. Nothing to enable, no cap on the number of tags, no cooldown between them. The tag is arbitrary text under the normal rules for an address: letters, numbers, hyphens, no spaces.
The + is legal. RFC 5322 has always allowed it in the local part of an address, which matters later when a signup form tells you your address is invalid.
Gmail has a second quirk people confuse with this one: dots are ignored, so [email protected] and [email protected] are the same mailbox. That one is useless for tagging. You can't tell senders apart by dot placement and you can't remember which variant you used.
Google's blog post explaining the plus trick went up in 2008. Eighteen years later it works the same way and Google still hasn't replaced it. The company has been testing something called Shielded Email, which would generate real throwaway addresses that forward to your Gmail, but as of August 2026 it's still unreleased with no date attached. Plus addressing is what you actually have.
Set up the filter, or don't bother
A tag with no filter behind it is just a longer address. Routing is the payoff.
- Open Gmail on the web, click the gear icon, then See all settings.
- Go to Filters and Blocked Addresses, then Create a new filter.
- In the To field, type the full plus address:
[email protected]. - Click Create filter and pick the action: apply a label, skip the inbox, mark as read, forward it, delete it.
For a one-off check without building anything, search to:[email protected] in the Gmail search bar.
One naming rule that matters: tag with the company, not the category. +netflix tells you who sold your address the day the spam starts. +entertainment tells you nothing, and you'll have used it on nine sites by then.
Why Gmail plus addressing stops working
Four failure modes. Three are real breakage and one is a misunderstanding of what the feature is.
The signup form rejects the plus sign
By far the most common. You type the address, the form says "please enter a valid email address," and you're stuck.
The address is valid. The form's validation is wrong. Somebody wrote a regex that allows letters, numbers, dots and underscores, shipped it, and never read the spec. It's one of the most common validation bugs on the web and it has been for twenty years.
There's nothing to fix on your end. Either use your bare address or use a different address entirely.
The site accepts it, then strips the tag
The quiet one. The form takes [email protected], and what gets stored is [email protected].
This is usually deliberate. If plus addresses count as distinct accounts, one Gmail account becomes unlimited accounts, which is a gift to anyone farming signups. The Lemmy project worked through this in the open and settled on normalizing plus addresses down to the base address for exactly that reason. Plenty of larger platforms did the same thing years earlier and never wrote it down.
Two consequences. Your filter stops matching, because mail now arrives addressed to the bare address. And your leak detection is gone, since the tag that would have named the culprit was discarded at signup.
Data brokers do the same normalization for a different reason: it merges duplicate records. Stripping everything between + and @ is one line of code, and the people buying and selling address lists run it as a matter of routine.
Your organization switched it off
If you're on a work account, this is probably your answer. Microsoft's documentation says plus addressing is enabled by default in Exchange Online, and gives admins a one-line switch to kill it:
Set-OrganizationConfig -DisablePlusAddressInRecipients $trueExchange also does something worth knowing about: when mail arrives for [email protected], it tries to resolve the full address first, and only if that fails does it retry without the tag. That two-pass behavior is why plus addressing on a corporate tenant sometimes looks like it half works. Google Workspace admins have their own controls. If the tag bounces on a work address, ask IT rather than debugging it yourself.
It works fine, and you wanted it to hide you
Not breakage. A mismatch between what the feature does and what people hope it does. Worth its own section.
What plus addressing does not do
It doesn't hide your address. Your real address is sitting inside the tagged one, in plain text, to the left of the +. Anyone who wants the base address has it by looking at the string.
You can't revoke a tag. There's no off switch on [email protected]. The best you get is a filter that sends it to trash, which is not the same as the address ceasing to exist. Mail still reaches Google's servers, still lands in a mailbox with your name on it, and still counts toward your storage. A SecondInbox address revokes itself on a timer, which is the difference between hiding mail and not receiving it.
A breach exposes the base address anyway. When the company holding [email protected] gets breached, the dump contains your real address with a helpful label attached telling everyone which service you used it for.
You can't send from it. Plus addresses are receive-only, which Microsoft states outright for Exchange and which holds for Gmail too. If you need to reply as that address, you need a real alias.
That last distinction is the one that trips people up. Plus addressing is a filing system, not a disguise. We laid out the three different setups that all get called an alias in what is an email alias, and plus addressing is the weakest of them for privacy while being the easiest of them to use.
Plus addressing outside Gmail
The + convention is an industry standard (the formal name is subaddressing), so it isn't a Gmail feature so much as a Gmail implementation of a common one.
- Gmail - Yes. No setup, no limit. Dots are also ignored.
- Outlook.com / Exchange Online - Yes. On by default, and admins can disable it per organization.
- Yahoo Mail - Yes. It also offers its own disposable addresses feature.
- Proton Mail - Yes. Free and Plus plans cap plus aliases at 10.
- Fastmail - Yes. It also supports subdomain addressing (
tag.jane@yourdomain).
Apple is the odd one out. Reports on whether iCloud honors the + conflict, and Apple's actual answer to this need is Hide My Email, which mints random forwarding addresses rather than tagging your existing one.
If Outlook is your main account, the Outlook blocked senders list is a separate tool with separate limits, and it's worth knowing both.
Use a temporary inbox for everything you won't log back into
Sort your signups by one question: do you ever need this account back?
Anything you'll return to (your bank, your shopping accounts, the subscription you'll cancel eventually) needs an address that still exists next year. Tag those. A real alias is better still.
Everything else is where tagging quietly fails you, and it's most of what you sign up for. A gated PDF. A forum you'll post in once. A free trial you'll abandon. A store you're buying from exactly one time. Tagging your real address for those buys you a label and costs you a permanent record of the transaction, sitting in your permanent mailbox, reachable forever. You've documented the exposure instead of preventing it.
SecondInbox is what we'd reach for instead, and it's what we built for this exact job. One click gives you a working inbox. No signup, no account, no password. Catch the verification email, walk away, and the address expires with the mail deleted from our servers. If a code is slow to arrive, extend the inbox with one click. Your real address was never in the transaction at all, so there's nothing for a form to strip, nothing for a broker to normalize, and nothing to surface in a breach dump two years from now.
The honest caveat: some sites block known disposable domains, which we went into in why websites block temporary email addresses. A tag gets accepted more often. It also leaves your real address in every database it lands in, which is the cost most guides skip past. Our advice is the reverse of theirs: reach for a temporary inbox first, and fall back to a tag only when a signup refuses it. The longer version of that argument is in temporary email vs alias forwarding.
Yes. It has worked the same way since Google documented it in 2008, needs no setup, and has no limit on the number of tags. What changes is whether individual websites accept the <code class="inline-code">+</code> at signup.
Usually a bad validation regex that treats <code class="inline-code">+</code> as an invalid character, even though RFC 5322 allows it. Some sites reject it on purpose, to stop one account being used to register many.
No. Plus addresses are receive-only on every provider that supports them. If you need to reply from the address, you need a real alias or a masked forwarder.
Not on its own. It tells you which company leaked your address and lets you filter that mail automatically, but the mail still arrives at your mailbox and the tag can be stripped by anyone with the address. To keep the mail off your real address entirely, use a disposable inbox like <a href="https://secondinbox.com">SecondInbox</a> for the signup instead of a tag.
Yes. Microsoft enables it by default in Exchange Online and Outlook.com, though an organization's admin can turn it off with a single PowerShell command.
It's the weakest kind. A real alias is a separate address you can delete independently and often send from. A plus address is your own address with a label on it, and it can't be revoked.
The take
Plus addressing is a filing system. Tag per company, build a few filters, and your inbox stays sorted better than manual triage will ever manage. As a way of catching which company sold you out, nothing else is this cheap.
It is not protection, and that gap is bigger than most guides admit. The +netflix is a label on your address, not a wall in front of it, and the address underneath is the same one your bank and your family use. Every tag you hand out is your real address handed out, with a note attached explaining where you used it.
So tag the accounts you keep. And stop spending your real address on the ones you don't: grab a SecondInbox address for the next signup you know you'll never log back into. One click, no account, free.
