20 years of Google Scholar

anti-spam is only an issue if people dump their email anywhere. I usually register my mail on webpages as first.last+webpage@mail.com and once they would spam this mail, it gets blacklisted.

I literally get only 1-3 real spam mails per month without any filter.

Words great, until a page rejects email with a '+' in it.

dots are ignored, can filter by john.doe@gmail.com

not sure about capital letters

Not everyone's cup of tea, but quite nice if one can afford it: I have my personal domain and a catch-all inbox. So if I want to register at acme-co.xyz I will just use acmecoxyz@my-domain.tld

Maybe I should start using random words though? Wonder if someone will go bananas seeing their brand's name on my domain.

Or just knows about this Gmail trick (it's been 20 years already) and sends spam to your real mailbox.

Actually, I am surprised _any_ spammy website these days would even honor the part after the +, and not just directly send to the real mailbox name.

I see this recommendation everywhere and I am genuinely surprised that it works. Any spammer can find out your real address since there is an obvious mapping from + addresses to your real address. An actual solution would hide this mapping.

Yeah. Fastmail masked addresses are random. The best you can do is guess that an address might be masked, due to it not being johnsmith@fastmail.com, but it provides no information about your real email address.

I used to require a "+..." on all emails. Any email that didn't have the "+..." was sent to Spam automagically. My family were whitelisted. I gave up, because too many websites (early on) refused to take the "+..." marker, so I ended up losing too much to Spam. It's easier to just let Google sort it out.

It's part of RFC 5233 Sieve Email Filtering: Subaddress Extension

Yeah, I've had to explain that a couple times already, usually when dealing with customer support or in-person registrations.

And a "malicious" actor can get away with pretending to be another company by spoofing the username if they know your domain works like that. I don't think this has reached spammers' repertoire yet, but I wouldn't be surprised.

Eventually I'd like to have a way of generating random email addresses that accept mail on demand, and put everything else in quaraintine automatically.

Good resource on this trick from 2010. It's not Gmail specific.

https://people.cs.rutgers.edu/~watrous/plus-signs-in-email-a...

Too late for most people.