5 ms·

The gmail + trick can be defeated, though. If you own a domain, you can use arbitrary addresses and it becomes more reliable. I use Google Apps (possibly not a

by pygy_ 14y ago

The gmail + trick can be defeated, though. If you own a domain, you can use arbitrary addresses and it becomes more reliable. I use Google Apps (possibly not a good idea but soo convenient :/) with a catchall. I didn't catch any offender so far... However (off topic), spammers are spoofing addresses as if they were coming from my domain. I receive two to three dozens automatic replies from mail servers (this address does not exist...). I've properly set up DKIM and SPF records, making it obvious that these mails are spoofed, but I'm afraid my domain will end up on grey/black lists... Anyone out here familiar with this kind of issue?

bathat 14y ago
I think a lot of sites have caught on to the + trick, though, because more are more disallow the + character in the email validator.
- kefs 14y ago
  I wish they wouldn't.. https://en.wikipedia.org/wiki/Email_address#Valid_email_addresses https://en.wikipedia.org/wiki/Email_address#Valid_email_addr...
- pyre 14y ago
  More like laziness. They probably only allow something like: ^[a-z0-9_.]+@(?:[a-z0-9-]+\.)+\.[a-z0-9]+$
  - jfoster 14y ago
    In my experience it's been ignorance rather than laziness. I suppose you could argue that the root cause of the ignorance is laziness. If someone is writing a validator, they probably ought to check what constitutes valid input.
- rhizome 14y ago
  It's not a sign of catching on, but of using an old email validation pattern from the days of Matt's Script Archive (seemingly). It's the sign of a website that has used cargo-code programmers. You're probably just seeing it more because you're trying to use plus-addressing more often (confirmation bias), but it's been this way for years and years. It's actually better now than it used to be.
pseut 14y ago
fastmail.fm lets you set up wildcard mx records -- so if your email is user@example.com, you can get email at company1@user.example.doc, company2@user.example.com, etc. instead of user+company1@example.com. I imagine other email providers do this too.
- alexkus 14y ago
  Hmm, that's a useful tactic as I'm seeing + addresses becoming much less effective due to the reasons I gave above.
- usefulcat 14y ago
  Yes, I have my own domain and have been doing this for years. It generally works as expected, and so far I've had at least four unique addresses that were leaked to spammers. One of them was the address I used for newegg. If you do go this route, I'd recommend using a whitelisting approach. I do get a lot of spam sent to random addresses at my domain.
  - MertsA 14y ago
    I've also had personal information leaked through NewEgg. For me it was my name and my parents email address when I got them to buy me a video card when I was 16. Eventually they got an email addressed to my full name and their email about car insurance rates or some random spam. I would really think NewEgg would be better than that.
alexkus 14y ago
The + trick is becoming well known with spammers anyway. I registered with one site as "something+else@example.com" having never used the "something@example.com" address anywhere and within a few days I was getting spam to "something@example.com" and "something+else@example.com". Whoever got that list of emails was clever enough to know to try removing the + portion. Obviously you can never give out the "something@example.com" address and then assume that everything that goes to that address must be spam, but I've had legitimate contact from companies who have had to email me by removing the + portion because their internal email system wouldn't allow addresses with a + in them.
- rhizome 14y ago
  They're getting a little wise, but that didn't stop me from receiving spam to "else@example.com" a few weeks ago.
driverdan 14y ago
I've been using catch all's for years. I get 100+ bounced spam emails a day from people spoofing my domains (also have DKIM + SPF). AFAIK none of my domains have ever ended up on blacklists and no one has had trouble receiving legit email from me.
- pygy_ 14y ago
  Good to know, thanks.

by pygy_ 14y ago

bathat 14y ago

I think a lot of sites have caught on to the + trick, though, because more are more disallow the + character in the email validator.

kefs 14y ago
I wish they wouldn't.. https://en.wikipedia.org/wiki/Email_address#Valid_email_addresses https://en.wikipedia.org/wiki/Email_address#Valid_email_addr...
pyre 14y ago
More like laziness. They probably only allow something like: ^[a-z0-9_.]+@(?:[a-z0-9-]+\.)+\.[a-z0-9]+$
- jfoster 14y ago
  In my experience it's been ignorance rather than laziness. I suppose you could argue that the root cause of the ignorance is laziness. If someone is writing a validator, they probably ought to check what constitutes valid input.
rhizome 14y ago
It's not a sign of catching on, but of using an old email validation pattern from the days of Matt's Script Archive (seemingly). It's the sign of a website that has used cargo-code programmers. You're probably just seeing it more because you're trying to use plus-addressing more often (confirmation bias), but it's been this way for years and years. It's actually better now than it used to be.

pseut 14y ago

fastmail.fm lets you set up wildcard mx records -- so if your email is user@example.com, you can get email at company1@user.example.doc, company2@user.example.com, etc. instead of user+company1@example.com. I imagine other email providers do this too.

alexkus 14y ago
Hmm, that's a useful tactic as I'm seeing + addresses becoming much less effective due to the reasons I gave above.
usefulcat 14y ago
Yes, I have my own domain and have been doing this for years. It generally works as expected, and so far I've had at least four unique addresses that were leaked to spammers. One of them was the address I used for newegg. If you do go this route, I'd recommend using a whitelisting approach. I do get a lot of spam sent to random addresses at my domain.
- MertsA 14y ago
  I've also had personal information leaked through NewEgg. For me it was my name and my parents email address when I got them to buy me a video card when I was 16. Eventually they got an email addressed to my full name and their email about car insurance rates or some random spam. I would really think NewEgg would be better than that.

alexkus 14y ago

The + trick is becoming well known with spammers anyway. I registered with one site as "something+else@example.com" having never used the "something@example.com" address anywhere and within a few days I was getting spam to "something@example.com" and "something+else@example.com". Whoever got that list of emails was clever enough to know to try removing the + portion. Obviously you can never give out the "something@example.com" address and then assume that everything that goes to that address must be spam, but I've had legitimate contact from companies who have had to email me by removing the + portion because their internal email system wouldn't allow addresses with a + in them.

rhizome 14y ago
They're getting a little wise, but that didn't stop me from receiving spam to "else@example.com" a few weeks ago.

driverdan 14y ago

I've been using catch all's for years. I get 100+ bounced spam emails a day from people spoofing my domains (also have DKIM + SPF). AFAIK none of my domains have ever ended up on blacklists and no one has had trouble receiving legit email from me.

pygy_ 14y ago
Good to know, thanks.