Microsoft adding support for custom '+' email addresses in Office 365
zdnet.com
zdnet.com
It's always fun interacting with customer service reps when they for example confirm my email address... "errrrrr yeah so we email you at ourname@...?"
That still leaves custom mailservers and non-alias (as in aliases via plus or dot, not actual mailserver aliases) which does give an indication as to who is sharing your data.
Of course when I complained they said it must have been something I did...
- "Oh! You work with us? At which store?"
I use this one for two or three vital services, like banking and receiving government messages.
Meaning i have some backup should i forget to renew the .email domain...
Of course, this only becomes an issue when the masses start doing it. I'm very surprised how few spammers remove tge +tag, given that that's semi-mainstream by now.
personally i don't worry about spam, i want to track who leaks their users email addresses, and then be able to filter on labels that have gone bad
If a mail comes in from an unknown sender to known address I know that the address is compromised.
Ideally I would like to plug my password manager to generate an address and automatically add email filters in place.
Although I was thinking about a service that would just give randomalphanumeric@example.com for all its users, so they would be on the same host and no connection between addresses could be implied. It could or even should be receive only.
If you do, how well does your 12 random letter system work for that use case?
Also, I once encountered a site where spam+xyz worked for signup but failed validation on the login form. I think it was something important too, like a utility or bank.
You're less likely to bump into issues with -.
Some shops don't like their trade name in the email, so rot13 (g? in vim) solves that if your goal is to trace back the leaks. I have not found a reliable way of auto dropping mail from bad sources, sometimes companies change name which makes it hard to validate From with recipient.
Even better: postfix and dovecot (as of v2.3) now both allow specifying multiple recipient delimiters. So if you run your own mail server you can specify as many recipient delimiters and switch between them if websites are being picky.
I wish seive were better supported in mail clients. It works fine on the back end, but I edit my .seive file by logging into the server and sparking up Emacs rather than being able to handle it directly from my mail client.
I figured sites wouldn't want to accept it because they know you are most likely filtering their emails so they have a much less chance of getting through to you.
If someone is stealing emails/passwords from a site obviously they will just strip characters after the plus to obtain your normal email address?
johndoe@gmail.com
john.doe@gmail.com
j.o.h.n.d.o.e@gmail.com
johndoe+spam@gmail.com
john....doe+spam@gmail.com
But sure, you could have `(my name is)john."..".doe+spam(...)@gmail.com` if you wanted to. Syntactically valid! The parenthesised bits would be stripped out before sending, and I have no idea whether Gmail would be willing to accept the quoted dots bit.
As for parens, I recollect the spec lets you nest your parens and quotes! It's insane. e.g. `f(oo."(bar."baz")."quux)@example.com` is valid in the spec.
I wrote an Oracle regex to parse for valid email addresses and I went against the spec rather than what is what's practically used. It was an insane thing.
For example: foobar@ foo.bar@ f.o.o.b.a.r@ are all valid and normalize the case without the periods.
bar.foo@gmail.com
gets rejected as email address doesn't exist when my gmail is bar@gmail.com
So if you wanted to use it like this you would try something like b.ar@gmail.com
It's been nearly 20 years since I added that feature. I assumed at the time everyone would do it when they saw how handy it is. For some reason that didn't happen...
I use tagname@myusername.mydomain these days, and that's still my favorite feature!
If the website is breached, the login isn’t a login for any other website, and advertisers have a harder time correlating your identity, and if you get spam you know who is the culprit, and you can stop the spam by deleting the alias.
With this, no need for any other antispam logic. Back to the mid 90s (which is a good thing as far as email traffic is concerned!).
Wish every provider would support this as I’m sure spammers have caught on to the plus addressing scheme.
Pharma spam, 419 scams, password leak crypto blackmail... remember that these miscreants rely on low costs to achieve their profits, so any sort of filtering is too expensive. They don't even filter out abuse@, postmaster@, hostmaster@, or mailer-daemon@.
You can use a shared domain:`hackernews@snorremd.kopi.cloud` Or, after setting up an MX and a TXT DNS record, you can use your own domain: `hackernews@mail.snorremd.com`.
You can change the "real address" of any "forwarder" (`snorremd.kopi.cloud`/`mail.snorremd.com`) to relay to any address you want, whenever you want.
You can block individual addresses like `hackernews@mail.snorremd.com` with two clicks starting from your mail client.
You can also configure individual addresses to redirect to RSS so you can read newsletters or other "chatty" services as part of your normal browsing habits.
It's a little longer to read over the phone, but I've never had trouble with it. And I've been able to tell a couple of companies that their email databases had been hacked or stolen.
Disclaimer: just a satisfied customer.
s/(\w+)@(\w+)\.(fastmail\.fm)/\2@\3/g
So for me, I have a few emails in my custom domain:
{firstname}@example.com
market@example.com
(there's others, but it's not relavent to this discussion).
market@example.com just goes straight to spam, as I don't use that email for anything. foo@market.example.com is used for each email instance. It works out extremely well.
Like if spammers and hackers were not aware of the + notation, and like if it wasn’t trivial to extract the underlying email address by removing anything after the +...
Unless you have an alias that completely obfuscate the underlying email, I just don’t see the point.
We would create different users for different roles. I would love to be able to use one email address distinguished with a tag.
and then spent a lot of time changing my email address in accounts that I've had a really long time.
Shocked at how badly that went, actually. For certain service providers, I couldn't change my email address and was encouraged to open a new account, which would've meant losing certain records in the old accounts. I couldn't consolidate.
And companies that have different email addresses for their accounts and their mailing lists -- not helpful.
And finally, companies that disable the "update your email address" link in footer of popular email list services, so your only option is to unsubscribe -- good going (not).
I've been trying to move in the other direction and its been exactly as much of a pain as you've mentioned.
Most of my email accounts are public email provider mapped to domains. But anytime I sign-up for something that's not tied only to one of my work endeavors, I use the non-mapped address. So, newsletters, sign-ups, Amazon account, etc. I don't use any mapped domains for those things, as those kind of come-and-go.
I segregate my personal email and my business emails from the @public-email-provider address, which I want to keep away from my other activities. It also puts all those mailing list emails, legal acknowledgements, etc., in one place as much as possible. I can filter and manage those in one place.
I also don't have a strong sense of personal ownership of that stuff. It's like a PO Box, not my house address. I don't check that account for human- initiated communication. That's my personal address (which gets almost zero traffic these days) and my work/business email addresses.
I have a strong aversion to the company behind public email provider. But I set a calendar reminder for a year out so I don't think about it much until then. I have some endeavors that will let me close up various business activities and centralize to one. If/when that's solid, I'll probably consolidate all my income-oriented business accounts and services [and probably somewhere else], but keep the public... as it's just a PO Box.
Unless you do some kind of verification and filter email sent to addresses without a valid suffix?
The hard part is social acceptance. This morning the Whirpool technician was very puzzled by me giving him whirpool@domain.tld as my email, although he accepted my explanations in the end. (I might use more opaque identifiers, but then I would forget about what is what, so for the moment I am trying to stick with this scheme, until it becomes too difficult)
Personally, i've just replaced the recipient_delimiter default value(+) with "." as that is basically impossible to strip out. Ex, firstname.COMPANY@example.net
I do get a lot of weird looks when handing the addresses out in person, but a quick explanation usually works. I just tell them, that if I start receiving spam from one one the addresses, I can just block it and be done with it. They sometimes counter with "but we won't spam you" and I acknowledge that with "but not everyone is so nice as you" or something like that.
ps: you can use multiple delimiters, so grouping is possible with firstname.bills.COMPANY@example.net
The only non-public email so far that has resulted in a lot of spam was the one I gave to the animal shelter when I adopted my cat. (I count unsolicited advertisements as spam.)
home@domain.tld is for anyone and anything dealing with my physical home. Delivery of an appliance, repairs, homeowner's insurance and such. I expect the email volume here to be low except when ordering something.
fly@domain.tld is for any flight reservations. That's pretty convenient, I can find any old tickets or travel details by filtering for this address, and I also know any incoming mail is likely an ad, unless I just bought tickets.
hotel@domain.tld is for all hotel reservations, and is even more convenient. Unlike flights, I never need any emails from hotels except to see that my stay has been confirmed.
And on the rare occasions I expect to need a throwaway email, I'll use somethingrandom@domain.tld and point it to /dev/null after receiving what I needed.
Edit: Downvote me all you want, they're still breaking the law… In the US there's the CAN-SPAM act (https://www.ftc.gov/tips-advice/business-center/guidance/can...) and nearly every other country has similar laws. Most of them require one-click unsubscribes to work.
It's still failure to comply even if it's due to negligence/ignorance/incompetence.
Individuals cannot sue under CAN-SPAM Act and I don't think any state Attorney General is going to bring a suit on my behalf because they didn't accommodate a plus alias.
https://consumercomplaints.fcc.gov/hc/en-us
The technical details as to why they are failing to unsubscribe you does not matter at all. What matters is, you've unsubscribed repeatedly and they are failing to register your intent.
'+' has no special meaning. The relevant standards only say that senders can't dictate how a system encodes its addresses. No law is in place to compel that behavior. If that were the case I'd love to force ISPs supposedly selling IP services to allow unencumbered use of port 25, residential servers, and transport protocols other than TCP and UDP.
> I have several services I will never be able to unsubscribe from because of the latter—and yes, I tried manually URI encoding it
As certain addresses get spam and/or I lose interest in the business I gave the address to, I add them to the blacklist. So far, I'm using AWS SES, which seems to be focused on the sending of marketing emails, and are not fussed on receiving, but includes rudimentary blacklisting. So far, it's zero cost.
Then I have a script that uses the AWS CLI to move all the mail from the bucket to a local dovecot server.
The whole thing is really hacky/experimental at the moment, and I haven't given out any addresses, so all that I receive is spam. But the spam I do receive is very little and quickly adds to the blocked recipients list.
Sending using SES uses the built-in SMTP server functionality at AWS and has very generous limits for one who is not marketing.
(Though on the other hand thankfully I'm still not getting much spam anyway and it's only a few addresses that were affected, so I only have a limited amount of data to go by.)
* https://en.wikipedia.org/wiki/Email_address#Subaddressing
Equals specifically is used by mailing list software (esp. Mailman) for bounce processing (VERP):
* https://en.wikipedia.org/wiki/Variable_envelope_return_path
First -- in GMail at least -- you have to explicitly set up a + account as being in your list of "from" accounts and then you have to remember to use it every time you reply!
Not to mention forgetting the email I gave them when resetting passwords sucks, too. "Was that foo+hn or foo+ycombinator or foo+ycombinator.com or foo+hackernews or... hm... uhhh..." (You need a centralized password manager, in other words.)
I've had several issues where I've replied and sending from the base-address means the conversation goes awry ("We don't recognize this email address"), or at best I still expose the base address because I only remember to reply using the laboriously-created-from-plus address about a fourth of the time.
I honestly don't see how that would work. Like, how would you unsubscribe to a mailing list? Most these days let you click a link rather than reply with "unsubscribe" but still...
I've had multiple occasions where contact /to/ a business needed to come from the email address I used to sign up with their service (automatic correlation to users I guess).
One particular exchange was particularly painful. Every email I sent was, I assume, routed to a new customer queue. Every email that I sent from my non-+ alias was delayed by days and then dealt with by an unhelpful "we don't recognize this email address".
It was very painful and it was all because I used a + alias as my supplied email address but kept forgetting to use it as my 'from' address.
Had I not had the ability to set it as my 'from' I'd probably have stopped using + aliases entirely.
This has only been allowed since RFC 822 (1982). Is there any reason why Microsoft did not support this from the beginning (of Exchange)?
"Microsoft 365" now includes all of Windows 10, Office 365 (Office on PC) and Azure. This is more geared towards the home market.
Then, there's "Office 365 for Business" which as the name implies is more for business/corporate customers.
It looks like your custom domain is using the old Outlook.com/Hotmail architecture, which already supported +<tags> in email addresses - while Microsoft's corporate offering (running on a cloud based Exchange Server) still doesn't, and they're pushing support for it out later this year.
> The local-part of an addr-spec in a mailbox specification (i.e., the host's name for the mailbox) is understood to be whatever the receiving mail protocol server allows. For example, some systems do not understand mailbox references of the form "P. D. Q. Bach", but others do.
I have added this capability to every commercial web property I've worked on.
I tried doing email validation the modern way: if '@' in emailfield then return True else 'email address needs an @'. The user gets a confirmation email anyway, and the sign-up process was literally name, email, tick a box that you read the privacy policy, and click continue, so they can just re-do that if they typo'd the address.
Iirc the boss decided to set requirements for a regex that I was to implement instead. Or maybe he made the regex and I tweaked it saying "this won't match .amsterdam domains", not sure anymore.
I'm pretty sure that's close to Microsoft's current attitude towards the Internet.
And it is not like you have to manage your own email servers. You can use services like fastmail or any number of email providers to receive email on your own domain. You also have the ability to change your implementation without changing your address. You can decide to host it yourself, or go to another provider without having to tell all your contacts that you are changing your email.
It becomes trivial to actually give out email addresses that are customized for the service. Instead of me+service@hotmail.com you can give out service@mydomain.com.
In my opinion, the money you spend for your own domain for email, is well worth it.
Tired of Microsoft users subscribed to mailinglists constantly breaking threading.
I created a new account without it, but I could not bring over my past reviews.
Microsoft Calendar is also pretty bad too. Like in a large organization you'll often have people leave the company. When you delete a series in Outlook with multiple people it tries removing the history for everyone which is important dates. There are a lot of nuances that would prevent me from ever switching to Office. Even OneDrive is tied to SharePoint and it is way too easy to break.