If bad actors cut off the +, fight back by not using your bare email at all: Provide everyone with a + address, ignore all emails that come without.
Edit: Downvote me all you want, they're still breaking the law… In the US there's the CAN-SPAM act (https://www.ftc.gov/tips-advice/business-center/guidance/can...) and nearly every other country has similar laws. Most of them require one-click unsubscribes to work.
It's still failure to comply even if it's due to negligence/ignorance/incompetence.
> I have several services I will never be able to unsubscribe from because of the latter—and yes, I tried manually URI encoding it
Individuals cannot sue under CAN-SPAM Act and I don't think any state Attorney General is going to bring a suit on my behalf because they didn't accommodate a plus alias.
https://consumercomplaints.fcc.gov/hc/en-us
The technical details as to why they are failing to unsubscribe you does not matter at all. What matters is, you've unsubscribed repeatedly and they are failing to register your intent.
'+' has no special meaning. The relevant standards only say that senders can't dictate how a system encodes its addresses. No law is in place to compel that behavior. If that were the case I'd love to force ISPs supposedly selling IP services to allow unencumbered use of port 25, residential servers, and transport protocols other than TCP and UDP.
As certain addresses get spam and/or I lose interest in the business I gave the address to, I add them to the blacklist. So far, I'm using AWS SES, which seems to be focused on the sending of marketing emails, and are not fussed on receiving, but includes rudimentary blacklisting. So far, it's zero cost.
Then I have a script that uses the AWS CLI to move all the mail from the bucket to a local dovecot server.
The whole thing is really hacky/experimental at the moment, and I haven't given out any addresses, so all that I receive is spam. But the spam I do receive is very little and quickly adds to the blocked recipients list.
Sending using SES uses the built-in SMTP server functionality at AWS and has very generous limits for one who is not marketing.
(Though on the other hand thankfully I'm still not getting much spam anyway and it's only a few addresses that were affected, so I only have a limited amount of data to go by.)