Gmail dots and plus aliases: how one inbox becomes 50 free trials

Here is the cheapest multi-account trick on the internet: take one Gmail address and add dots or a +tag. To your signup form, each variation is a brand-new user. To Gmail, they're all the same inbox, so the abuser can click every verification link.

How Gmail addresses work

Two rules make this possible for gmail.com addresses:

1. Dots don't matter. Gmail ignores dots in the username: john.smith@gmail.com, johnsmith@gmail.com and j.o.h.n.s.m.i.t.h@gmail.com all deliver to the same inbox. (Google)
2. Plus addressing. Anything after a + is ignored for delivery: johnsmith+trial1@gmail.com delivers to johnsmith@gmail.com. Users rely on this to filter mail, which is a legitimate use.

Also, googlemail.com is the same as gmail.com.

With a ten-letter username, the dot rule alone allows hundreds of variations. Add +tags and it's unlimited.

What it looks like in your signup data

johnsmith@gmail.com
john.smith@gmail.com
johnsmith+1@gmail.com
j.ohnsmith+free@gmail.com
JohnSmith+7@googlemail.com

Five accounts, five sets of free credits, one person. Paste your own recent signups into the email alias checker; it runs in your browser and shows the groups.

Normalizing correctly

The fix is to compute a normalized email and use it to detect duplicates.

export function normalizeEmail(raw: string): string {
  const email = raw.trim().toLowerCase();
  const at = email.lastIndexOf("@");
  if (at < 1) return email;
  let local = email.slice(0, at);
  let domain = email.slice(at + 1);

  if (domain === "gmail.com" || domain === "googlemail.com") {
    domain = "gmail.com";
    local = local.split("+")[0].replace(/\./g, "");
  } else {
    local = local.split("+")[0]; // optional for non-Gmail providers
  }
  return `${local}@${domain}`;
}

Rules that keep you out of trouble:

• Never send email to the normalized address. Store what the user typed and send to that. Normalization is only for matching.
• Dots are a Gmail rule. Don't remove dots for other providers: john.smith@outlook.com and johnsmith@outlook.com can be different people.
• Plus addressing is wider but not universal. Many providers support it (Outlook, iCloud, Fastmail, Proton), but some company mail servers treat + as a real character. Stripping +tags for every domain gives more matches with a small risk of merging two real people on unusual servers. For a free tier, that trade-off is usually worth it, but it's your call.
• Google Workspace domains (company addresses hosted by Google) may also ignore dots, but you can't tell from the domain alone without an MX lookup. Most teams don't bother; the common abuse is on gmail.com.

Enforcing it

Add a column and an index:

alter table users add column normalized_email text;
update users set normalized_email = lower(email); -- backfill with your function in app code
create index users_normalized_email_idx on users (normalized_email);

Then, at signup, check for an existing account with the same normalized email. Choose your response:

• Hard rule: "An account with this email already exists." Clean, but it also blocks the legitimate person who wants a second, separate account.
• Soft rule: allow the account but don't grant free credits a second time. This is the credit gating approach, and it's usually the better one.

Should a +tag alone be suspicious?

No. Plenty of careful users sign up with name+yourproduct@gmail.com to track who sells their address. Treat an alias as a weak signal (BurnGuard weighs it at 15 out of 100) and let it matter only when it combines with others: the normalized address already exists, the signup comes from a datacenter IP, or the same device has created several accounts.

That's the difference between annoying privacy-minded users and stopping farmers.

Clerk and Supabase users

Clerk now offers subaddress blocking as part of Clerk Protect (Clerk docs). On Supabase you can do the normalization in a before-user-created hook; see blocking disposable emails in Supabase Auth for the SQL.

Beyond aliases

Once aliases stop working, farmers create real Gmail accounts in bulk or move to disposable domains. The next layers are a disposable domain check, IP and velocity signals, and device reuse. The multi-account playbook covers them in order.