Dots don't matter in Gmail addresses | Hacker News Reader

Dots don't matter in Gmail addresses

support.google.com

170 pointsRocketSyntax311 comments

I have been getting financial emails from several people for many years at my GMail ID. They apparently have given my address but without the dot.

But what mystifies me is how these people keep going for years without ever realising they aren't getting account transaction emails (from their banks), notifications of stock trades, even OTP emails etc. How is it possible for people to use these services for years without ever wondering why they aren't getting the routine emails they're supposed to get or even why they aren't getting the OTP email they had generated?

Also none of the institutions I contacted to ask their clients to update their correct email bothered to do so. On the contrary they sent me back what looked like automated replies asking if their customer service was satisfactory.

At this point I'm sorely tempted to delete my email and start over with another service provider. The nuisance of having to delete almost a dozen emails not meant for you every single day is annoying to say the least. At least with spam you get it sent to spam folder and there it stays. Confidential emails not meant for you is awkward and uncomfortable to have to put up with.

Set up a filter? Did you ever try to contact the institution where the emails come from?

Yes, I do have it filtered. And yes, contacted all the institutions. They don't bother at all in updating their records. And these are banks and other financial institutions. One would think they'd take the integrity of their data more seriously.

Yeah, this is a tough one. You can't just have random people saying "please change this email for another person" without permission, on one hand, but you violate other codes if it's clear you send med or financial info to the wrong people. That's why you get so little actual info in emails from bank and medicals these days.

But without a confirmation process to verify correct emails, this will continue as a fact of life, just like wrong phone numbers in the last generation, and wrong postal addresses in the gen before that.

Set it up to forward to their support e-mail addresses...

"they aren't getting account transaction emails (from their banks)"

I had a bank account I thought I had closed, but hadn't. Finally noticed and closed it 10+ years later. We moved around a lot.

> At this point I'm sorely tempted to delete my email and start over with another service provider.

Why not? Or you could start over without deleting your current email and go into Gmail settings > Forwarding and POP/IMAP > Add a forwarding address, and make it forward all of your emails to your new provider, where it should be easy to sort all emails from your old address to a certain folder or tag that you only check and clean, say, once a week (for any senders that don’t have your new email).

> But what mystifies me is how these people keep going for years without ever realising they aren't getting account transaction emails (from their banks), notifications of stock trades, even OTP emails etc. How is it possible for people to use these services for years without ever wondering why they aren't getting the routine emails they're supposed to get or even why they aren't getting the OTP email they had generated?

Perhaps they also get paper statements in the mail and text message notifications, and don't even know that they also are being sent redundant emails?

(It can go the other way, too. I think I've got some of my financial institutions configured to only send me email and text. If one was also still sending paper statements and those were going to the wrong address, I'd never notice).

You can filter your gmail based on the TO field (so anything without the dot goes to spam) if you like. I've done the same thing myself intentionally: I give the dot-less version to sites/companies where I need to receive an email or two (account confirmation etc). Then I manually grab them from spam and then forget the whole thing knowing I'll never see the other crap they send me.

Hope that helps, as someone with a common name I sympathize enormously.

I've done this — I have a filter to move any email I receive without a dot into a "Not For Me" folder, which I periodically go through and usually send a canned response back about how they probably have the wrong person.

You can also automate this part, perhaps to reply with "You probably have the wrong person, but if it is actually for me I'll get back to you shortly".

You can also append “+whatever” to the username part of your gmail address and filter it that way.

E.g. johndoe+mailinglist@gmail.com

Unfortunately some services won’t accept that as a valid address.

Others strip it too

And most email scrapers / aggregators these days also ignore the + and whatever comes after.

I wrote about this issue on my blog. Basically just using email aliases on a custom domain to enable per-provider filtering, and deletion of the alias if they ignore unsubscribe requests or get hacked. https://jonpurdy.com/2020/06/using-email-aliasing-to-detect-...

I use this all the time, everywhere I can.

The worst example of "we know what are valid email addresses better than anyone" case was when adidas.com decided that they'd redesign their registration flow and in the process disabled logins with "invalid" email addresses when they previously had accepted registrations and logins with email addresses tagged with + for years. That was genius.

I've encountered the same problem. One day I'm going to stop being polite and cancel the Hotel Reservations, Conference Invites, and other shit that this guy keeps signing up for using my email address. Maybe that will get him to finally pay attention.

I imagine then you've probably gotten receipts/confirmations with the person's phone number. Have you tried calling him and letting him know?

You'd think so, but nope! In addition to the fact that about half the emails are in Spanish (my doppelganger appears to be a Central American doctor?), all of them seem to contain the bare minimum of info that would allow me to actually contact the person in question. And, ya know, you'd think a hotel or a financial institution that is notified they have someone other than the actual customer's email on file would be quick to correct that, yet so far I have never received so much as an acknowledgement from anyone that they will correct their records and try to seek out the account holder by other means.

I've marked most of them as Spam at this point, so hopefully Gmail's filters are simply learning to automatically send anything in Spanish to my Spam folder.

Have you tried emailing them? You have their email address apparently ;)

I have a common name, also a name used by a huge construction firm. I own firstnamelastname@gmail.com and firstnamelastname.com . There is no hope for these people. I have tried everything under the sun to get them to give out the correct email address.

What I HAVE noticed is that it's usually transcription error. These people that share my name are writing down their email with a pen and paper and a secretary or transcription service is inputting it incorrectly. Lately I reply back to hotel confirmations asking for a complimentary hotel upgrade with lots of extra soap in the room.

Yeah that's not going to help. I've got a guy using my email address for close to a decade. When it started, he was a high school student ordering lacrosse equipment. More recently he was buying a house -- I received the contract.

If my email is foobar@gmail.com, his is foobar7@gmail.com.

You'd think 10 years would be enough time to learn the difference, but nope.

That's when you start embarassing the person.

A group of students included my email address in their project discussion. They ignored my emails asking to remove my address. So I started replying as if I was a part of their project, but requested/suggested slightly stupid things. They figured it out real fast after that.

If you have the person's actual email, CC him on all that. If not, include a note saying your a different John Doe and to please remind the John Doe they want to reach, to use his own email address.

Reset their account passwords.

I’d rather not commit a federal computer crime thanks

They provided false credentials. The account is yours.

I did this once when someone created a Facebook account using my address. I let it go for a year and then did a password reset and deletion. At the time there was no requirement for email verification so the account was fully functional. Again, this is Facebook's responsibility to verify new accounts. A confirmation email link is last century's technology.

Moreover, what happens if this doppelganger is committing crimes via said account and investigators track you down from the email. It is in your best interest to eliminate these accounts. Kindly explaining the situation to non-existent customer support will get you nowhere.

They provided false credentials. The account is yours.

IANAL but I don't think it works like that. Ownership is not the same as control.

Ownership was never established in the first place.

Sure it was. I create an account, accept the terms and condition and put in your email address, your phone number and your street address. It's still my account, I am the one that accepted the conditions (you would cry foul if you were bound by the conditions you didn't accept).

If you want to be legalistic then the person who used the wrong email is in violation of CAN-SPAM[0], though my guess is courts don't have the time for petty matters like this.

[0]https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003

Only if it was willful. We've kind lost the point of the OP but the example was accidental miss-typing and in my hypothetical above I meant accidentally

You have no legal business relationship with a service you've signed up for with no exchange of funds. An EULA is not a contract and they fully indemnify the service provider anyway. All you've done is initiate the creation of some database entries on someone else's property.

You have no legal business relationship with a service you've signed up for with no exchange of funds.

Yeah, no. Peace out dude, I'm done here.

I don't think this analysis is legally or ethically correct and I certainly would not want to have to test it against the CFAA in court.

There's an xkcd for everything. Sure, that's probably my email address.

https://xkcd.com/1279/

Annoyingly that is different, everything after the + is _ignored_ so only one person can have <first>+<any lastname>@gmail.com. Other people I am guessing use first.lastname and that is where the confusion is. =)

The XKCD cartoon isn't talking about a literal plus symbol.

If you took it literally that would imply the actual email address is a single letter @gmail.com and although some ex-SRE people and others at Google have said there were ways to get short addresses for employees, nobody has suggested a single letter would be available even for them. For normal users the minimum was six characters.

I created and removed several single letter emails as part of a test once, and I made several short names (mine, spam@, etc). The biggest problem was that too short would take the backend down because it received more mail than could be indexes at the time so too short or too common would get deleted to protect the system. As far as I know Randal still has his though. :-)

But yea your right about the plus I guess Ii didn't read it detailed enough.

The plus sign in the comic might just be meant to denote string concatenation (in other words, jsmith@gmail.com, not j+smith@gmail.com).

Same. The ones that surprise me are the credit card information or cell phone plans. I was able to contact the phone company and tell them to remove my address, but the credit card was an exercise in frustration. You can't get through without account or personal info. I just mark most of them as spam these days.

Forward the email with the explanation you've given to abuse@<sender>. Most companies should have someone monitoring such an inbox. If that doesn't work I'd call the desk of the cto or shame them on Twitter.

Same exact issue. Especially with people from Africa for some reason. I get a lot of stuff from 3 people from Kenya, Zimbabwe, and South Africa. Most everything there is managed by phone, and they just use my email as a throw-away address. The guy in South Africa has a collections agency after him. The guy in Kenya likes to order food delivery quite a bit. I occasionally change his order to extra spicy. The guy in Zimbabwe works for a college of some sort. I make sure he's signed up for all the educational trips to Europe.

Also some senior woman in Oregon, who is a frequenter of "silver singles".

Some industrial supply company in Canada is very confused by the fake Groupon I sent them for the free stuff they are trying to bill me for.

Some guy in Australia has his security deposit box setup with my address, and is way overdue on some payments.

(I've tried multiple times to correct the wrong email address of the people I mess with, and have been ignored)

Lots of US political junk mail, from many localities, both parties. LOTS AND LOTS OF KINKY PORN SITES.

Fortunately none of them have the dot in the address and I have a filter to send them all directly to trash.

I don't receive any junk mails anymore after switching to my custom domain.

It’s weird, but that’s been my experience too. I switched off Gmail (where I got tons of spam, although most properly caught by the spam filter) several years ago, and have received fewer than 200 spam emails in total since switching. I know this because my new host won’t allow the personalized spam filter to be enabled until you’ve received 200 spam.

I’m not at all careful to keep my email address hidden on the internet either.

It never occurred to me that it might be due to being on a custom domain. I figured either I was just lucky, or that there’s less spam these days.

I think you are lucky, I get around 5-10 spam mails on my custom domain daily. Granted, my address has been in a few data dumps.

Eventually you start getting a bunch of spam. I feel most of mine originated from GitHub and data-leaks.

Tip: configure a catch-all to your email address, and use custom email addresses for every website. I love having e.g. news.ycombinator.com@gilani.me and being able to filter out bad email addresses whenever they become tiresome.

I've also configured Mailgun on the domain (not what it was intended for but ¯\_(ツ)_/¯ ) so whenever I need to send an outgoing email from one of my custom addresses, I use their SMTP credentials.

At this point, I've been me@ amin@ heyamin@ and even notamin@gilani.me.

Setting up catch-all email addresses is a recipe to get absolutely inundated with spam.

Possibly, but I pipe my email through Gmail so I haven't noticed.

I'm the only email address on my domain, and I haven't set up a catch-all. I use my actual email address to sign up for anything that requires a signup. I don't have a junk account, and I don't use +-aliases. I don't hide my address; it's listed on my website, in my HN profile, and likely in a bunch of random places on the web, unobfuscated. In general, I just don't worry about it.

My GMail spam folder has around 10-15 messages in it per day. My inbox is nearly always fine. The nice thing that GMail does is sort promotional emails that it doesn't judge to be outright spam under the "Promotions" category, which I don't see unless I seek it out. That one still isn't that bad, on the order for 10 per day, but it is genuinely stuff I don't care to see.

If I were to move away from GMail (which is on my todo list), I'd have to figure out what to do about those. Likely they mostly have unsubscribe links; after a quick scroll down the list, I think it's nearly all from companies that I do have or had an existing relationship with.

I wish GMail had an "unsubscribe" button so I don't have to hunt through emails for their often-hidden unsubscribe link. Yes, I could click Spam and then "Unsubscribe + Mark Spam", but I really want just "Unsubscribe", but that's not an option.

I do have a fairly uncommon last name, so it's not something that spammers might accidentally put in a word list to use as an email domain, but overall I've just mostly not cared about "protecting" my email address, and it's mostly not been a problem. Is this entirely atypical? If so, I wonder why...

> Likely they mostly have unsubscribe links; after a quick scroll down the list, I think it's nearly all from companies that I do have or had an existing relationship with.

At one point I decided to actually hit the unsubscribe links rather than just archiving these emails. Turns out I was subscribed to nearly 200 different mailing lists. But there were only 1 or 2 that wouldn't let me unsubscribe.

There doesn't seem to be a lot of undirected spam. No one seems to be harvesting git repos, for example.

I keep dedicated email addresses for most purposes, and the two that are getting any are a random mailing list, and the kickstarter address. That one has been caught in a vortex of spam, clearly meaning that kickstarter can't keep their mouths shut about customer emails.

I'm pretty sure the campaigns get your email address, I often get emails directly from them.

I've got a catch all email redirect for my address. I do get a decent volume of spam these days.

Most of it goes to:

* admin@<mydomain>.com - listed in whois publicly for a few years, understandable

* <dropbox's address>@<mydomain.com> - started coming in 2014, the fact they were breached only became properly known in 2016.

* <my first name>@<mydomain.com> - This is the actual email address I give to in person contacts. Not quite sure how it ended up on spam lists, my best guesses are from a recruiter sharing it, git commits (though the fact the address I use way more commonly for git isn't there indicates probably not) or someone just figured it out.

with all the data breaches spammers have millions of verified email addresses no need to scan the web for more.

I get a couple emails a day, which is about how much I was getting when I was on Gmail. However, I have been much less careful with my address too–I think spammers might just be less likely to mail custom domains because those addresses might be more likely to be invalid.

I, too, am 95% better after switching away from first.last@gmail.com to something@firstlast.com and using g-suite on that domain for the last decade or so.

I gave up on Gmail for all the same reasons as the stories in this thread.

Fortunately I have a rather unusual last name so I have first@last.dev. It comes with the bonus of having it work for my future children as well :p

> The guy in Kenya likes to order food delivery quite a bit. I occasionally change his order to extra spicy.

> The guy in Zimbabwe works for a college of some sort. I make sure he's signed up for all the educational trips to Europe.

Both made me laugh, you are a wild man!

Same exact situation here. I have {commonFirstName}.{commonLastName}@gmail.com and get so much legit email without the dot for other people with my name. There’s at least a few of them - a retired vet, a substitute teacher in Ireland, a middle school student in Montana. And just this week I got some from a bail bond place for a kid in Texas that included his picture. I don’t understand how these people aren’t constantly confused about not getting emails they expect

I get the same thing all the time. I think it's relatively common for people who signed up for Gmail early, and thus we able to get a bare named email (i.e., no numbers afterwards like john.doe420).

The weird thing for me is that it seems to be more than just a single person writing down the wrong email or using it for junk mail. I have gotten emails from places all over the US, a couple places in the UK, and in the past year or so from someone in France. And while some of it is junk mail, I've gotten emails about rental agreements, company emails, insurance policies...

I used to try to be nice and email people back and tell them they had the wrong person. Now I just delete them. It's not worth the time and effort. Unless it's a kind old lady sending an email to her grandson, it's getting deleted. Hopefully their insurance company or whoever will call them after not hearing a response. Unlike regular mail, there's no consistent "return to sender" function, so...deleted.

I have a fairly common first name and last name and I thought I was a genius when I jumped onto an early gmail invitation in (I think) early 2005 to bag my "firstname.lastname@gmail.com".

Now I realise I was a chump and should probably have just stuck with sexxiboi69@hotmail.com

> sexxiboi69@hotmail.com

If you put that on your resume and they hire you, it's probably a good place to work.

My gmail address is simply my lastname @ gmail.com

So I get a lot of emails meant for other people whose email is firstname.mylastname@gmail.com where some sender drops the firstname and the dot for some reason.

I received airline reservations (where I can click and change seat assignments!), cancer diagnoses(!), wedding invitations, bank statements, real estate documents to verisign, all sorts of things.

I've been tempted to do things like switch the person's seat to a middle in the back by the bathroom, but while I've clicked through to see if I _could_ do it, I never actually completed it. I did once send my regrets to a wedding invitation.

Probably best you didn't. Unauthorized use of a computer system, even if you have the credentials, is considered hacking, at least in the US.

I've sent a physical letter, when I got an electricity bill with a home address.

A week later I got an apology email, and the incorrect emails stopped.

What's strange to me is why they thought that email address would work -- after all it's not their address. I've got years of emails from France for the same reason.

You can set up a filter for the incorrect version of your email address (any email to namenodot@gmail.com) and get those out of your inbox.

Lots of people don't understand how the Internet really works, or realize that there might be another person with the name of the person they're trying to contact.

Been there. I posted about this before but I own a 5 character common first and last name @gmail.com address. I get misdirected emails _constantly_.

Usually I am polite about it and let people know, but sometimes I make a game of it. I was invited to participate in a drum circle with an offer to pay for my flight to which I replied that I would love to join, but they would also have to pay for drum lessons. I got a mother insisting that I come home for the weekend to which I replied that I am home, perhaps she hadn't knocked hard enough.. etc.

At one point I got like 15 emails deriding me and my choice to "not support firefighters". Turns out that a member of a city council had listed his email as councilman.<me>@gmail.com and most people just ignored everything before that period. I took it as a challenge to see what the most outlandish thing I could say was that would be believed. Some of the better attempts: "My wife had an affair with a firefighter once!" and "My house has never burned down, why do we even need these guys?".. etc.

With most of the financial emails you can unsubscribe at least. =/

That poor councilman…

Likewise -- I fall firmly into this XKCD https://xkcd.com/1279/

My e-doppelgängers have priced cars across the state of Ohio, been active in the PTA, pursued higher education in Germany, and seems to always be interested in commercial real estate in the outer boroughs of NYC.

Though once -- I received an email asking me to please just apologize to my sister already.

I replied, "I think you have the wrong email address; I don't have a sister."

I saw a response -- "HOW COULD YOU SAY THAT? Your mother is crying." I thought it best to just walk away at that point.

Reminds me of this: https://www.youtube.com/watch?v=beb8zCGMsbI

Never thought it'd happen to me, having come across this topic before, but I'm happy to say I can join this club.

It's the same guy, who works in a Eastern European country, where I emigrated from.

The first instance, he was asking his supervisor to use his vacation time so he and family could make a trip to Mecca for Hajj. I chuckled and ignored it.

Second time random picture of some massive metal parts from what looked like some factory he works at.

Third time was this year, very recently and I received a pretty unnecessarily detailed email about how he had to turn back home because he had soiled himself while driving to work... That one made me worry he had gotten Covid.

I guess I'm this guy's boss now.

almost positive 6 is the minimum character length for gmail addresses.

almost positive 5 + 5 > 6

nono.. its a single word that is common as a first and last name. There are a BUNCH of cases where its applicable! =)

But yea, 5 characters. I was an early gmail SRE so I was able to circumvent the restrictions. =)

Was it <gecka@gmail.com> ?

No.. but iirc I made that one at one point before abandoning it.

See my comment above.. It is, I was a Gmail SRE that could circumvent the restrictions on that. =)

> I own a 5 character common first and last name @gmail.com address

Were you a Google employee? Or did you mean something other than how I read this, that your first and last name combined are 5 characters? Because I believe 5-character usernames are not permitted for gmail addresses.

I tried to confirm this and provide a link, but all of support.google.com appears to be non-responsive right now. When it stars working again, this may support my assertion: https://support.google.com/mail/answer/9211434?hl=en

I was an early Gmail SRE so I was able to circumvent the restrictions. It was a bad idea it turns out. For a project I also created "spam@gmail.com" and caused a production outage due to the volume of mail it got forwarded. =)

But yes your right, 6 characters is the minimum of "open" gmail accounts. I know of at least a dozen 2 character accounts created by insiders though.

I am 'pwinnski' nearly everywhere now, because on April 1, 2005, I was not allowed to create a gmail account of only the first five characters. Goodbye to 15 years of the old 5-character username, and hello to what is now 15 years of the new 8-character username!

At the time, I thought about pestering my Google-employee friends, but decided to just suck it up.

Synchronicity: You joined HN June 28, 2016 I joined May 8, 2016

Weird. I wonder if you told me about it back then, or it was a coincidence.

That is such an interesting question; it could be either one IMHO, with equal likelihood

that's a fantastic outage :)

I got a friend that also snatched a 5-letter Gmail account back in the day. He was kind enough to facilitate that I get one to but I got my own domain since forever so didn't get to get one.

> I was an ... SRE ...... I ... caused a production outage

I have nothing to add, except that you made me smile on a Friday afternoon.

Nearly all SRE's have caused an outage of some kind... The trick is to design your systems well enough that even when there is an outage few/no people notice...

Google war story: we used to get digital badges on our employee profiles to indicate useful things like ability to write c++ or python, or having worked on a specific project, etc. I got "porn cookie" for working on the safe search stuff.

Anyway, I designed a badge called "I broke Gmail" that would get applied to anybody that did exactly that. I intended a hint of shame but I got a wall of emails asking to get it with explanations of how each had broken the service at some point.

Unsubscribe, man, I'm jealous.

Some dude 2,000 miles away from me has bought a Lexus and now I get regular emails about the status of his vehicle, receipts for all work done to it, and reminders of all maintenance not done to it. For a year and counting.

Each email helpfully includes instructions for unsubscribing: First, you log into the Lexus app...

I finally got fed up with it and reported them to abuse@.

Well, since you have the email, you can log in to the Lexus app. Then you could turn off the notifications.

I'm not sure about this but wouldn't that be a felony?

Yes.

99.9% chance no one would care. But people do freak out over this stuff.

Knew one guy that saw that a Bank got hacked on the news. Did an nslookup or similar to check the banks site.

He was arrested the next day and expelled from college for hacking the bank.

Eventually all got cleared up, but screwed up a year of his life

He got expelled for running a DNS query?

Do you mean nmap?

Maybe. Was awhile ago

Yeah, I'd rather not take a 0.1% chance of losing my rights for life over some spam email.

Can you claim you thought it was your account? Then, to demonstrate you knew it wasn’t yours, they’d have to collect various proof, and this demonstration being erratic and risky, they’d probably not attempt a trial.

I can probably claim whatever I want, but given I've never even looked at a Lexus dealership in my life, I doubt I could pull it off.

I'm not sure either, but couldn't you argue that it _is_ your Lexus account? It has _your_ email on it after all. That is the single important identifier attached to the account. The other stuff doesn't matter.

Just create a filter to auto delete them

Perfectly reasonable solution but somehow just unsatisfying.

In the old days, when I ran my own mail server, I used to enjoy rejecting them with custom SMTP 550 messages.

Now I can't do that so I hard to resort to bothering the poor folks at abuse@.

In my defense, they have emailed me from 3 or so different domains/services, so I've had to set up a filter more than once.

As the lucky early adopter of gmail I got my last name only @gmail.com. It has been a blessing and a curse.

I have a boilerplate "you have the wrong address" email in multiple languages that I use to reply to the first email from real people. If they persist they then get added to my auto-reply "you have the wrong address" and delete rule.

For automated emails, I don't even bother trying to unsubscribe. They all get added to the delete blacklist rule.

Some of the more fun mistakes I have gotten have been multiple years worth of tax documents from New South Wales, Wine Tastings in South Africa, Church Choir concerts in Germany, and resumes for a receptionist in Colorado at a Gym.

I have a similar address and get a lot of similar email.

My personal favorite was a contract offer to play for a minor league baseball team in the Midwest a few summers back.

I also once got hired by the National Park Service for what sounded like a nice gig as a park ranger.

Ohh yea I forgot that I got mailed a bunch of movie pass financial details while they were still a hot property! That was.. erm.. eye opening.

Try having a 3 char username (@gmail), it never ends.

I have the same but it seems to be one specific person in Canada (I'm in the UK). I started getting emails about college prospectuses and applications, then I started getting them about library fines. I tried to email the library and inform them that they had the wrong email address and got nothing back. The latest has been emails from a car dealership trying to confirm some options for a new car.

I can't believe this person is missing so many emails that are presumably quite important to them. I can only assume they have the same first name as me but spelt differently and that other people are typing their address in wrong to various systems.

These days I just ignore every email like that, mostly for fear that one day I'll end up stuck with someone trying to hold me responsible for something.

Or, contact the legitimate recipient, and tell them to sue the bank.

It’s very rare to have any other contact information for these people. It’s not like you can email them. :)

I've purchased a truck in Florida, been going to college in (I forget which state) for a few years now, opened an LLC AND filed for divorce with Legal zoom, was part of a venture partnership with multiple personal invite and discussion emails about investment meetings, and more! I've responded many times to these and the only replies are from the last one, and Legal zoom (who told me sorry, disregard it??)

I had someone open a bank account with my email and I called the bank thinking someone was stealing my ID or something. How do people not know their own email address?

I have someone using my email, who best guess doesn't understand Gmail and Twitter are two different things - they have the matching @name on Twitter.

Same, but my concern is that some day one of these people will convince Google support that they own my account and then I will really be hosed.

> But what mystifies me is how these people keep going for years without ever realising they aren't getting account transaction emails

I put the blame squarely on those vendors. "well, we made them type it twice, what more do you want?" Please, please, just pretend it's a communications channel and close the loop!

Notes from BankCorp Ticket BUG-14333: "CIO saw some post on HN so we need to change the email validation. Make them type it three times."

Because they never received the first one, so it's not abnormal to miss the n emails after that.

I think this is the real answer. For those people there is no disruption in communication, because it never begins in the first place.

Why not filter? If you know you always use the dot, filter without the dot. It works for me when I tried to set it up. Can even blacklist certain senders specifically so that if there are a few out there you made without the dot you will still get them.

I get a guy's bank info from the east coast of the US. Recently, he started using Zelle. His Zelle activity was being emailed to me. One of his Zelle recipients used a phone number. I was able to call her, get his phone number and tell him about this issue. He still hasn't updated his email address. I don't get it...

Yep, I live with this too... I thought it luck that I got <my_last_name>@gmail.com early on, turns out it was a curse. It's not a _common_ last name, but people with the last name seem to assume it is theirs, or maybe people miss the other letters in addresses they are given and just use the last name?

I used to get periodic emails from an elderly German couple giving me their train itinerary for their upcoming visit. I politely reply that I'm not their cousin, and consequently their cousin probably won't be there at the train station when they arrive. And then six months later it all starts again.

I have what I assume is a distant cousin on the east coast and I get an email with an invoice every time the pest control folks come out to his house to spray. No option to unsubscribe, and I've given up calling the company to let them know they have the wrong address.

There is a fellow in Quebec whose <first_inital><last_name> == <my_last_name>, and for a while I got monthly emails because someone was trying to wire him money. Again, no option to unsubscribe.

Lately I've started getting emails from universities interested in admitting another distant cousin in Oregon. I'm guessing some college lead-generation service crossed her name with my email (her/our last name). I haven't figured how to handle that one yet, I'm contemplating printing a few out and (snail) mailing them along with a note.

But I've had the address long enough that I don't want to let it go, so I guess this is all a necessary burden......

> But what mystifies me is how these people keep going for years without ever realising they aren't getting account transaction emails

The inverse happens too! Sallie Mae regularly snail mails me to tell me that the (snail mail) address they have on file for me — the same one they send this notice to — is undeliverable! I get all the normal mail (like account statements), too…

I get physical mail for a previous owner, even though I've lived here for five years. Usually I notice, I write "Not at this address" and cross through the address in Sharpie then shove it into a mailbox, per regulations.

More recently I forgot to check the front before opening. I realised when the contents were about a mortgage account, I don't like debt so I certainly wouldn't have a mortgage.

Apparently the previous owner still has a mortgage on this place, which would worry me if not for the fact I have monitoring set up so I know the Land Registry says it's mine, which means even if the idiot bank thinks they've got security for a loan they are wrong and the government will cheerfully tell a court of law that if asked. Hopefully they just didn't update the name of the mortgage and actually security is now in the form of some other property bought with the proceeds of the sale to me, but who knows, these idiots didn't understand "Not at this address" for five years.

I decided to call the bank about this mistakenly opened letter, but because of COVID they weren't usefully taking calls. I could remain in a queue for fifteen minutes and then get automatically dumped out with "We're sorry" if I wanted. So I just chucked the letter in the recycling.

If you need a recommendation for a Bank never to do business with in the UK (certainly not to trust with regards to where their customers live) it would be Halifax.

My gmail doppleganger signs me up for mostly animal charities and religious stuff. I keep unsubscribing and marking as spam. Sometimes I wonder if she does this on purpose, giving a "fake email" to people she doesn't want to deal with. If so, Diane, there's a real person with that email, and quit throwing all your spam at me.

And that's why email senders need to do double opt-in.

I'm confused. Do people just assume they can think of an email address and Google somehow knows and assigns it to them automatically?

Like they're signing up for something and put in "santosh83@gmail.com" and think "My name is Santosh and I was born in '83. Google obviously knows this and will send me this email!" ????????

I can't see that being the case (except exceedingly rarely) but perhaps if they had "santosh83@live.com" on an MS device and then got a device with Google mail they think their address is now "santosh83@gmail.com"? Or they're just nuts ...

If you ever figure out why people do this or what their thinking is, let me know, but yeah this actually happens. I have a common name but a long and uncommon surname, and I have name.surname@gmail.com.

This GP from New Zealand signs up for EVERYTHING under my gmail account. A handful of it spam, but mostly important stuff - notifications for financial transactions make up most of the mails I receive.

I have called his offices repeatedly to try to discuss it with him, and even have a reasonable rapport with his secretary, but he never wants to take my calls.

I really cannot figure out why he does it.

Is he in Auckland? If it's my GP I'll take it up with him for ya :P

Could be something like this:

Had first.last@comcast.net, but migrated to gmail and had to use something else. Then they misremember and hand out first.last@gmail.com.

You can set up filters in gmail to either automatically go to a different folder ("label" they call it), or to just delete them. It's not hard at all once you get used to the interface, and there's a wide variety of rule options.

You get financial emails, I got about $1,200 through quickpay / zelle via my email address.

Still waiting for them to contact me at the email _they_ used, to ask for their money back. I have no way of contacting them as the sender info is hidden.

I share a name with a builder from Queensland and have been getting his email for years - loan applications, hardware receipts, updates about his rental properties, apprenticeship schemes - you name it. What's insane about it is how many people insisted they had the correct address when I used to follow up.

A coworker of mine got an email once containing important scholarship information intended for a high school kid in Florida. He did a little looking online and found the kid's and his parent's actual email addresses and forwarded the email to them.

So here's where it gets weird/dumb: the kid replies to my friend and his parents and says, "hey mom, you put the wrong email address on my application, there's no dot in mine."

So my coworker, being the only tech savvy person on the thread replies. "Well, actually, [...]" and explains how dots are(n't) handled in Gmail address. Then the parents then reply and write, "but that's your old Gmail address, we had to get you a new one when we moved to Florida."

At this point my coworker gave up and the kid presumably lost his scholarship because his family didn't know you could keep your Gmail address when you moved houses.

(If you're reading this, hi Jake H.!)

> At this point my coworker gave up and the kid presumably lost his scholarship because his family didn't know you could keep your Gmail address when you moved houses.

Didn't your colleague forward the information ?

I think their meaning was they stopped replying to further email back and forth with people who clearly were very far from understanding and whose ongoing conversation was becoming increasingly frustrating to deal with due to their misplace mental model around how email works which then then relied upon to continue to correspond with the sender.

I occasionally see a public-ish figure with a website where they publish their email address. This last week, saw someone who advertised their "@cox.com" address. I move way too often to have any kind of confidence in a utility email address like that.

You mean cox.net? I think cox.com is for COX employees. Comcast does the same thing with comcast.com and comcast.net

Possibly, I looked up cox.com and it redirected to https://www.cox.com/residential/home.html so I thought that might be it.

I remember seeing @cox in the email though.

I have a common last name and my email is my first initial and my last name.

I get so much misdirected mail that I don’t even try to help these people.

I hope John gets to his zoom interview for Deputy Chief of Police later today, because I’m not going to tell him about it.

I'm in a similar situation. I was lucky enough to claim my Gmail address during the beta.

For the first few years I tried to be kind and alert the sender, but it just became impractical to do so.

It breaks my heart when I see my name twin receiving state benefit notifications or HR notices at the wrong address. He's currently applying for quite a few electrician openings. Good luck, my man.

Happens to me all the time, because my name is fairly common. Weird that Google wont "fix" that.

I ... hope Google never tries to fix your name being fairly common.

Out of curiosity, what would a "fix" look like?

Never showing the email address to anyone, just letting you scan a QR code, or copy-paste a rich-text non-editable widget and passing it around. It is the same idea as not showing the URL in the address bar, it solves 1 major problem and raises dozen others.

Happens all the time to me. Some of my fellow [first-initial][last-names] are "smart" people -- a professor and a judge, among others -- and I know that they are putting in their own email wrong.

I know this because I'm frequently getting mail from automated systems for something they filled out.

I mean, I know there's an xkcd about this, but seriously? How do you mistype your own email address so often? In both cases, their real addresses are [first-name][last-name].

Probably due to their workplaces using different schemes

e.g. My personal is [firstname].[lastname] and work is [firstinitial][lastname]

If I didn’t use macros I’m sure I’d eventually mix them up too.

> you could keep your Gmail address when you moved houses.

In understanding what went wrong here, it's worth noting that historically it was more common to have your email service provided by your ISP. If you moved to a house that wasn't served by the same ISP, your new ISP provided email bundled with the rest of the service at no extra charge, and you didn't want to keep paying to retain your old email, there were circumstances under which a move of house might have motivated a change of email.

Of course this was never relevant to gmail, but it might have been a part of the reason for the confusion. Or it might very well not have.

You will often see people in France who have a @internet.provider address.

The law here is that once you have it, you can keep it when changing providers at no cost, they have to make it available to you.

I always found it weird, especially when you have so much choice of provider-free ones (less in France than in other countries but still)

I (and I believe most of us) never use the email address that the ISPs provide, just so we can have our own. Who would ever want to use the HenryBemis4618362783@ISP.com???

The 75% of people who don't know you get a choice.

I do not understand what "have your own" means. I HAVE mine, the internet box gave it to me and it works.

^^^ this is the reality of the world , with people for whom edge = internet.

Of course you can get your domain and self-host your MTA (I am sure that this is what you are doing because who would ever want to be dependent on some provider, seriously). You are in the 10^-(whatever)% of the population that understand these words - and that's the reason people have firstnamelastname7656@isp.com as the address.

Happens to me all the time but not due to dots. People just don't know their own email addresses.

similar. A younger fella has my first and last name. I've gotten iphone receipts and questions on when I'm coming back to the Y (in very far away location). The best was when I got his deployment orders. I figured I probably was not supposed to ship out on a submarine, so I reached out to the sender to let them know. /shrug.

Everyone in this thread is replying with instances of receiving emails meant for other people, but dots have nothing to do with that. It's people typing in the wrong email address in a signup page (with dots or without), and the service not verifying it. The latter is what really needs to be fixed.

I personally find this Gmail feature (as well as the ability to append +anything to your email address) extremely useful.

In my experience, it's mostly the situations where people give their emails in person that are a problem: Receipts from in-store purchases (and in-store credit card signups), hotel reservations and rewards programs, EMR signups, lawyers offices, banks, realtors, etc.

Websites are pretty good at verifying email addresses these days. The real world, not so much. The super funny part is when you try to ask the bank/doctor/etc. to stop sending someone else's personal info to your email address, and they tell you they can't make that change since you aren't the account owner.

Thank you! I am also confused by some of these complaints.

Another possibility is that companies try to guess your email address. I recently got an email thanking me for buying a lawnmower that I never bought. The buyer's mailing address was in the email, so I sent him a letter. He replied saying he's "old school", and doesn't have an email account. He has no idea how the manufacturer got my email address, as he had left the email address field blank when filling out the warranty form. The only explanation I can come up with is that they just guessed it based on first and last name.

I think that companies' failure to verify their users' email addresses during signup is a serious problem that goes beyond any dot confusion.

When John Smith signs up for an account using JohnSmith@gmail.com (or John.Smith@gmail.com), and the company trusts John Smith to have provided the email address accurately, three parties are affected: Both John Smiths and the company itself. Yes, verifying email address creates a bit more signup friction, but the consequences of getting it wrong way outweigh that friction for the privacy risk and confusion it causes (unless all the company cares about is a meaningless sign-up metric).

Amazon has been sending me someone else's order details for about a year now. It's crazy to me for multiple reasons:

1. They send this information (order details, name, address, tracking numbers, receipt) without requiring a confirmation email. In fact, in their system the email on the other guy's account is labeled "unverified".

2. The emails contain no way to stop future emails. There's no "unsubscribe", "this is not me", "contact us", etc. Every link is to an Amazon page which expects the user to be logged in to the correct account.

3. The system does not sufficiently lock old accounts when the account email is reused. One suggestion from Amazon was to create a new account using my email, which should lock the other account. This did not happen, so now there are two accounts able to send Amazon emails to me with no way to tell them apart.

4. The Amazon website doesn't verify the user's account before displaying order details. If I click on a link from the other person's order return (or other types of links), Amazon opens up to my account but displays information from their order. It's confusing to see someone else's "refund status" alongside my account name on the official Amazon.com site.

5. Getting this fixed is a pain in the ass. I call, they say they'll fix it. I call, they suggest something else. I call, they escalate, try something else again. I chat, can't be handled over chat, they call me, try another thing. I'm not sure why they won't remove the email from his account or contact him and ask him to remove it.

Some of them also only allow you to unsubscribe or contact support through logging in to your account. Which I could easily do through a password reset but that's illegal so I'm not going to bother.

I'm still getting credit card statements from an Indian bank. I can confirm the PDF password is easily cracked :)

This is indeed the case. I have checked it myself. The link below shows how this can be used maliciously.

https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-t...

I do not know if this has been mitigated.

OP of that post has an ad at the bottom for their product that I actually found compelling.

It's a screencast tool- but instead of putting a video of your face in the corner, it overlays/ghosts your face on top of the full screen you're sharing.

Now sure how well it would work in practice. Maybe it's too distracting.

But it looks like a neat thing to try.

James is wrong, this is Netflix's fault. The same "scam" would work under a variety of circumstances because Netflix relies on something it has no reason to believe is true. Maybe you signed up to Netflix but your house mate thinks she did, she gets an email because of Eve, now you're both paying for Netflix, but actually she's paying for Eve's account.

Netflix could make this mistake with postal addresses even, if for some reason they used postal addresses. You get a letter from Netflix, you don't notice it's addressed to Eve, who had stupidly written your address instead of hers, you pay for her Netflix.

This is a data protection violation, data processors have a duty to take reasonable care that the personal information they have about data subjects is correct. If you need it, make sure it's accurate. If you don't need it, don't collect it.

This is actually Google's fault. Because Google is large enough Netflix could be nice and have special handling for Gmail addresses but this would be going against the email RFC that says $inbox1+$subaddr@domain == $inbox2+$subaddr@domain iff $inbox1 and $inbox2 are identical.

Netflix has zero idea how any particular email operator mangles or maps inboxes to actual users. Apple's private email service maps all sorts of inboxes to the same actual person. Mailinator maps every address to everyone.

This is Netflix's fault for not verifying email addresses before taking payment details for a recurring subscription.

True, Netflix should have verified that the person signing up could actually receive an email at the address they gave.

But in addition Netflix is right to allow the creation of two accounts where the difference is only dots.

There is no RFC specifying the interpretation of address formats. Every domain can use whatever scheme they wish. The RFC only declares that senders can't impose additional formatting rules on receivers.

Wouldn't the real James be notified that someone used his email to sign up for another Netflix account? When 'Eve' signed up for Netflix with james.hfisher@gmail.comm the signup confirmation would go to jameshfisher@ inbox?

Dots does matter in GSuite's email addresses (those are the email addresses for enterprise via work or school.)

Also in the email name part of the email address, anything after + (plug sign) and before the @ (at sign) don't matter either. [1] This is the same behavior for personal Gmail and GSuite email (Gmail for enterprises)

[1]: https://gizmodo.com/how-to-use-the-infinite-number-of-email-...

It definitely is. For example I get a lot of emails sent to me+ni@mydomian for "Not Important" which I use kind of like an RSS reader. They never appear in my inbox and I catch up on them every once and a while.

You can do this for a wide variety of things and combine it with filters to get a lot of extra value from your email.

You'd be surprised how many legacy registration systems break because of the + 'trick'.

Ever since I got a basic Gsuite plan and set up a catch-all email address, I can just use websitename@mydomain and then use filters which is oh so practical!

Not only do dots not matter, you can suffix "+<anything>" to your user name before the "@gmail.com" and it will still come to your email address. I actually love this "+" feature and use it a lot .. like send an email to "+bookmark@gmail.com" to bookmark a link, or register with "+nospam" and setup a filter for that address if anyone sends me email on that.

This is supported by icloud and fastmail too.

Also a good check if the site has some sloppy implementation. More than once have I seen that my "+" email was not accepted because of invalid characters. I take this as a sign to not trust the site's security too.

If I were a site accepting email addresses, I could see rejecting "+" stuff because chances are it's people trying to pull something funny like registering multiple accounts when I only want one per email address. If I were less confrontational I might just silently strip the "+" part.

Sites that do any of that stuff are infuriating. Great if that's what you're going for.

My understanding is that it's okay to be infuriating if I have an analytics query or something claiming that it'll not affect 99ish % of users and also save customer support a bunch of work.

This is not always accidental. Facebook, for example, does not allow a '+' in your email address and you cannot tell me that the engineers at Facebook don't know about the "+" in gmail addresses. The simplest explanation is that Facebook wants to make sure you are not signing up with an alias account. That is, they want your _real_ address, just like they insist on having your real name and other personal info.

"This is supported by icloud and fastmail too."

No, this is neither supported nor not supported by any email provider - it is part of the email specification. It works that way with all email systems, unless they are non-RFC compliant.

This, to best of my awareness, is not correct.

It is not a part of RFC5322, RFC2822 or RFC822 - nothing in those RFCs establish any particular semantics of local-part (the part before "@"), and in terms of syntax IIRC those RFCs only defines the escaping rules (backslashes, quotes, etc).

RFC5233 mentions the established practice of using a separator character that splits local-part into "user" and "detail" pieces, but does not standardize any particular syntax for the separator (it cites "+" and "#" as possible examples). Moreover, this RFC is about Sieve language, and it is out of its scope to define such standard for email addresses.

RFC3696 mentions "user+mailbox@example.com" but does not define any semantics, merely citing this as an example of a valid email address, then going to how it must be escaped in a mailto: URL.

It is completely up to a particular provider to implement (or not) any subaddressing syntax and any logic related to it. No email specification I'm aware of makes this a requirement. (It's not like I've read every email RFC thoroughly, though, so I could be missing something.)

Lots of places don't like the + in their email address validation logic.

The dots are probably more reliable, but are not as flexible. The best you could do is a secret code for yourself.

Got a guy with my same first name and surname.

Been getting his bank statements, his amazon orders, class emails, share purchases/sales.

Its a joke.

Edit: been happening for around 5 years.

Its also entertaining at the same time to see what he's doing on another continent. I'm torn, dammit Google!

I have this problem, except it's a whole nation (seemingly) of people due to how common my last name is in a specific country.

My address is [first initial][last name]@gmail so anyone with a first name that starts with the same letter as mine and the same last name (which, there are SO MANY).

I get;

job offers family photos (I typically respond letting these people know they're not getting through to whoever they're intending) verizon bills (I'm also a verizon customer and they absolutely refuse to take my email off of the other two accounts - I've also texted both accounts since they're numbers have come through various times in the correspondences and they don't even acknowledge my communication let alone update their accounts - they're always late on their payments, but have the newest iPhone's all the time :D) purchase receipts from so many retailers I don't keep track (some of these people have real silly amounts of money) auto purchase receipts bank emails lease offers (just today I had to respond to a leasing agent who was trying to let someone know they got a place they were trying to rent in NYC for crazy money)

It's mind blowing to me how many people get their email address wrong and miss so many important emails, seemingly without ever realizing it.

There is also the alias of googlemail.com on the domain level... Always a cause of big headaches.

  johnsmith@gmail.com
  john.smith@gmail.com
  johnsm.ith+foobar@gmail.com
  j.oh.nsmith@googlemail.com

all are pointing to the same logical email address.

The email you see in my profile is backed by a Gmail account, but I doubt you would know that if I didn't tell you. Hopefully I haven't made your headache worse ;)

You can see that it's backed by gmail by looking at the MX records.

https://www.whatsmydns.net/#MX/saagarjha.com

My email is firstlast I use first.last for subscriptions I am unsure I want to keep. I can then filter out based on to address and also use diff combinations when I already know I don’t want them contacting me (firs.tlast) for example

If you use the + character (e.g. `firstlast+subscriptions`) it'll still arrive to your `firstlast` inbox, but will allow you to filter it more meaningfully.

I've been using this trick for a while (usually 'firstlast+per_service_identifier') and I've encountered more than a few systems which erroneously claim that any email address containing a '+' is invalid.

That's why I now own my domain, and added the first([\.-]suffix)?@last.tld -> first@last.tld mapping at my provider.

For selfhosting, there's `recipient_delimiter = +-.` in postfix' config. [0]

The most infuriating ones are those where you can subscribe with the '+', but the unsubscribe function errors on it.

[0] https://try.popho.be/email.html

Also in many cases I am allowed to proceed with the +, but never receive confirmation emails because the sending system chokes.

You could encode the service_identifier in a pattern of dots around the letters of firstlast for cases where the '+' is not allowed. But that's probably hard to do in a way that's easy to encode on the fly, unless you already know morse or something similar.

Also doesn't work if I'm not using Gmail :)

I have used it all the time over a dozen years, both for site-specific email addresses and also for having lots of handy test email addresses in my personal app development. Often I just wish I had been more disciplined about using it even more for site-specific addresses, but fortunately more websites about friendly about unsubscribing these days.

I have a fun story about this.

I had an account on some site and didn't use it for years. When I go back and try to login they demand I reset my password and verify my email. Sure, no problem. Thing is I used a foo+bar@ email and they had a little sanitizing script running that removed it when submitting the form. Rewriting their spaghetti and getting the form to submit successfully was fun. I was very surprised it worked. Guess they weren't sanitizing on the backend.

Some services recognize this and do not allow email "aliases." One reason is that it essentially would allow you to sign up for an endless number of trials with the same email account.

The level-up for this trick is if you have your own domain, and a provider that lets you use a wildcard alias (Fastmail, for one), you can use anything@yourdomain.com. On the fly. No way to block that!

I like that idea. I use Fastmail, in fact. So I could use hn@yourdomain.com or any address specific to a service.

I guess the risk would be potentially not remembering that was done or exactly what was used. Also, could keep you locked into Fastmail or limited to providers who have this same feature.

Luckily, there's a lot of providers that offer this :)

I did that for a while, and then my provider decided that people using catch-all e-mail addresses were causing their systems to store too much spam and stopped letting people use them.

That left me in a slight bind as I had used well over 50 different e-mail addresses. I had switched to Gmail as my primary e-mail address, but hadn't bothered changing my accounts. Luckily, they allowed a very easy way to create forwarding addresses and basically set it up to forward 50+ addresses to one.

So “firstlast+@gmail.com”?

Dots do matter in G Suite email addresses, and that can be quite confusing for people that know this trick.

This is the source of a low-impact but still interesting scam: Scammer signs up for netflix free trial with "your" email (but it's really some new combination with different dots). Scammer runs out the free trial. YOU get an email saying "gotta pay for netflix." You're confused but chalk it up to some computer glitch somewhere and click the link to log in. Your password isn't taking but that's fine you just reset it. Finally, you're logged in, and you plug in your credit card and everything seems fine. You maybe don't even notice the two charges on your next credit card bill.

Yes, it's definitely convenient that you can have "multiple" email addresses that all point to the same inbox, but the issue is that identity providers don't treat them as all the same logical email address which creates opportunities for scams like these or worse.

90% of the spam I get when I occasionally review it has dropped the dot in some silly effort to canonicalize my address, so yeah, the dot matters, as I filter the non-dotted address.

Same here. The "no dot goes to trash" rule catches an awful lot of spam.

Someone registered for Facebook with myname@gmail.com. I'd registered with my.name@gmail.com and when I got the email that I'd added the account I clicked yes before reading (that's a mistake you make at most once) and now that guy has a Facebook account I can't log in to and I can't remove this email from the account and I can't remove the notifications either.

Part of the reason is that Facebook verifies you're the owner of the email if you say "someone else has my email" by sending you an email which you have to reply to. But Google will reply to all of them with the canonical sign-up so mine has my.name@gmail.com that the reply goes out with, which doesn't match so I'm stuck marking all Facebook notifications as spam.

Password reset?

Won't let you in unless your friends (well, his friends) validate it's you. Tried it!

In gmail, open the settings, go to "Accounts", add an address to "Send mail as ..." then you can send mail with as many dots as you like.

Could have sworn I tried this. Let me give it another shot! Thank you!

EDIT: Interesting, they no longer send me that email. Probably got flagged.

Thank you. I had no idea.

I am convinced someone with a gmail address similar to mine is causing me issues. I think at one time gmail may have considered dots differently. Because I was getting emails for an account that was clearly not mine. But the email address had a dot and the domain was not .com.

There's a difference between the address in the "To" field of an email and the "envelope recipient" that actually controls the delivery of the message. The "To" field is never used for delivery, and in fact an email will be delivered perfectly well even if there's nothing in it. That's why you can Bcc everybody and they all still get the message.

I used to have a dot in my gmail address then I started receiving messages to my address without the dot. The messages were from people I didn't know to people I didn't know. I thought there was something wrong and I was receiving other peoples messages.

And this is where it gets weird... I was.

Just not because of the dot. My gmail handle is pretty short, 6 chars. First name last initial, pretty cool. I got it during the early in the first beta year, (gmail was beta for like 10 years.) However 10 years later I'm now receiving emails in german, parking tickets from cities I've never been, paid subscriptions, access to gmail and facebook accounts because people set my gmail handle as their recovery address. I can even unlock a guys car from the manufacturers web UI whom I've never met. The best/worst by far is the time the FBI reached out to me, which I thought was some bad phishing attempt and replied mildly taunting them. However, it was in fact a real FBI agent who wrote back noticeably annoyed at my flippant response. There was a vailed threat that if I don't take this seriously things would happen. A lump formed in my throat. I called them and for 5 minutes it was kind of scary. I found out a doctor had been using my email handle for oxytocin prescriptions and they were investigating this doctor... I explained that I had received other messages for this doctor and approximated his age and name, explained my short desirable email address, at which point the agent broke their stern professional tone and we shared a little chuckle.

I love the way most services treat dotted addresses as separate addresses. So for example if you wanted multiple accounts on $service you could register the following:

    john.doe@gmail.com
    j.ohndoe@gmail.com
    jo.hndoe@gmail.com
    joh.ndoe@gmail.com
    johnd.oe@gmail.com
    johndo.e@gmail.com

And now you have six accounts, with the bonus of receiving mail in the same inbox for each account!

You can also add multiple dots :)

Yes but I imagine most services would spot that as an invalid address? Although it's worth trying something like

    john...doe@googlemail.com

To see if it passes as a valid address. Don't use this for evil, okay?

No, not multiple dots in a row. They still have to be between two non-dot characters.

Two dots in the email instead of one:

    j.o.hndoe@gmail.com
    j.oh.ndoe@gmail.com
    j.ohn.doe@gmail.com
    j.ohnd.oe@gmail.com
    j.ohndo.e@gmail.com
    jo.h.ndoe@gmail.com
    ...
    johnd.o.e@gmail.com

And if you somehow didn't know there is the possibility of adding +anything to your email, so that you can do john.doe+servicename@gmail.com and know which service leaked your email to spammers/advertisers

you can do that with gmail with the + character.

john.doe+beta@gmail.com john.doe+delta@gmail.com

they all go to the same address

You can also use @googlemail.com domain name instead of @gmail.com to double the number of email addresses.

Yes, you could do even more shenanigans registering with the following:

    john.doe+uniquestring@gmail.com
    j.ohndoe+uniquestring@gmail.com
    jo.hndoe+uniquestring@gmail.com
    joh.ndoe+uniquestring@gmail.com
    johnd.oe+uniquestring@gmail.com
    johndo.e+uniquestring@gmail.com

    john.doe+uniquestring@@googlemail.com
    j.ohndoe+uniquestring@@googlemail.com
    jo.hndoe+uniquestring@@googlemail.com
    joh.ndoe+uniquestring@@googlemail.com
    johnd.oe+uniquestring@@googlemail.com
    johndo.e+uniquestring@@googlemail.com

Oops there's a mistake there; there's supposed to be just one `@` symbol!

It is worth noting that these are different addresses. They all go to the same inbox but that isn't part of the "email API".

Of course some services don't like this so they special case gmail.com addresses to try to block this but it is perfectly legal for a mail server to route these to different mailboxes (such as GSuite accounts do).

well, using the dot between any two letters or not, you have 2^6 = 64 combinations (without even using double or triple dots...)

I was blocked from my gmail account for attempting to log in without the dot. My address is firstname.lastname@gmail. Had it for years. When I learned that dots don't matter I tried to log in without the dot and was immediately blocked for suspicious behavior. Luckily it wasn't used for anything important. Few months later the block was removed. Never tried to play with the dots again since.

The obvious address of <my common name>.<my very common surname>@gmail.com was still available a couple of years after Gmail was introduced, and I rushed to register it despite already getting a little unintended email on other predictable free mail addresses.

I couldn't anticipate the density of misplaced email (allowing me to link multiple parties to the same idiot), the personal insistence of some people (come on, it's me! Your friend —! What do you mean by "I don't know you"?), the ready-made drama (in varied roles: vanished boyfriend, investor in shady businesses, councilman, delinquent debtor...), the quality of delicate misplaced information (with medical records and resumes topping the more obvious invoices, home addresses and bank letters) and the variety of accounts (including e.g. Spotify and a couple of dating sites).

Over the years, I've noticed a slight decrease in incorrect addresses entered by human beings matched by an increase of automated emails to incorrectly registered accounts.

When I got out from college, i created my gmail account via a invitation link from a friend (In 2006, there were invitation based sign-up). I created gmail id without any dots in it and just firstnamelastname@gmail.com,

Later I joined as software engineer in a company, I came to know that good email is firstname.lastname@company.bla format, so I wanted to have my gmail id as firstname.lastname@gmail.com But it wasn't available. I was so desperate to have it that I decided to email the person who owns it, so I emailed on the id (having dot in it).

Guess What! I received my own email, requesting myself to handover the id. Then I did some tests to know if dot is making any sense or not. so tested like first.name.last.name etc.

Found this link way back then. Great to know that someone else found it after so long :)

I signed up years ago with a dot in my username, before I knew this. Folks can reach me sans dot, but my username still has the dot (so, outgoing mail does too). It bothers me a lot!

If there is a Googler reading this with the power to remove the dot from my username, please email me (with or without the dot) :)

You misunderstand the article. Your username has no dots, and dots are allowed but ignored when your username is referenced (when logging in, when receiving messages, etc). Nobody can remove the dots from your username because they aren't there in the first place.

If you just want a different number of dots in your outbound mails, go to the gmail settings and add a new presentation under "Send mail as ..." and set it as the default.

> add a new presentation under "Send mail as ..." and set it as the default.

That's what I needed -- thanks! The dot still shows in my Gmail profile, and it's not possible to remove the "Send mail as..." address with the dot; which is odd. But yes I'm also able to log in without the dot.

I have a similar issue, though it's not related to Gmail.

I registered an obvious joke email address from a free service. I'm not going to type it here, but imagine something similar to "fakeaddress@example.com". (I could have used a gmail address for the same purpose.)

Occasionally someone will fill out an online form that asks for an email address, and decide to use an obvious fake, assuming that any emails will go into the proverbial bit bucket. That's why I sometimes get emails about someone's health insurance or airline tickets.

It can get a bit frustrating when online support forms insist on asking for account information when the whole point is that I don't have an account.

(Yes, I know I set myself up for this.)

That, and '@googlemail.com'. example@gmail.com is equivalent to example@googlemail.com.

@googlemail.com was the default address for a few years in the UK because of a legal dispute. If you sent an email it'd always come from the longer domain.

For reference: https://www.theguardian.com/technology/2005/oct/19/news.busi...

What about + signs? That's the trick I use.

They also don't matter, but you already know this

In theory, providers/servers should ignore everything from the + to the @ so that should work just about everywhere else. And since most forms don't filter that out, you can make numerous "unique" addresses connected to a single one.

Now odds are, someone is going to respond with the one service where the + becomes significant..

> providers/servers should ignore everything from the + to the @

Why? I'm not sure it has ever been a standard and it's certainly not a default implementation for most providers?

A quick google search returns https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr... . Although not standard, its use is "legal"

There is a standard, RFC 5233 on subaddressing: https://tools.ietf.org/html/rfc5233

Adoption is a mixed bag.

Been using this for a while -

https://github.com/johno/normalize-email

That is a shamefully bad library. There's a million ways this is broken but the worst by far is that it lowercases the local part. Case MUST be preserved in the local part.

It is fine if you want to try to block duplicate emails, but you should always continue to use the original. But yes, it has false positives and false negatives. I don't think I would call it "broken".

But at the end of the day doing this kind of comparison probably raises more questions than it solves.

It's not even fine for that. If you assume that JayNesmith@ and JayneSmith@ are duplicates, you're eventually going to annoy someone.

Does MS Exchange or any other relatively big email server allow multiple emails with mixed case? As far as i'm aware all of the big consumer providers (Google, Yahoo, Outlook) don't allow it.

That isn't the theory. There are almost no rules for the local part of an email address and you must not attempt to "validate" them. Whether a '+' terminates the user name or means nothing is entirely up to the domain operator.

The exception being when you know that the domain operator supports RFC5233 then you're allowed to be aware of subaddresses.

That does this RFC even say? I read it twice and it seems to say "Some mail servers may use the part of an email after any character as a subaddress which doesn't affect which inbox a message is delivered to."

It seems to only talk about the receiving server and gives no way for the sending server to do anything useful as it doesn't specify the character to use if the receiver implements it at all.

I think this is good, I would like to not have senders try to guess anything about the structure of my email, but it makes me wonder what the point of having the RFC at all is.

That's part of the RFC email address spec. Ignoring .'s isn't, AFAIR.

Nope, the + trick is not standardized. The RFCs only specify that everything before the @ character is specific to the recipient system and Should Not Be Messed With; even case-folding that part of an e-mail address is a no-no, since the recipient system might distinguish case, and the sender has no way of knowing.

The + trick arose later, as a feature of certain mail recipient programs like Sendmail and Postfix, and most of these programs allow you to change from + to any character you like.

Subaddressing or "plus addressing" is a standard defined in RFC5223.

Note that RFC5233 doesn't actually standardize the delimiter. It uses "+" "#" and "--" in examples.

All RFC5233 does is specify how sieve (a protocol for specifying server-side email filters) can describe filtering on subaddresses. It does not confer any actual interpretation on email addresses, especially since many email providers don't actually use sieve for their email filters.

Which RFC spec? Not 2822?

RFC5223 defined subaddressing.

I'm surprised that the "+" operator isn't commonly known either in gmail (eg. I can type "johnsmith+345@gmail.com", and mail sent to that address will redirect to "johnsmith@gmail.com"

I think that for Enterprise customers (G-Suite) dots might matter as I tried to create a new (bot) account in Github with my email sans dots and I never received the email (email was not @gmail.com)

This is mentioned in the article, yes. It is likely to preserve backwards compatibility with pre-existing email addresses from before the switch to Gmail.

I registered forename.surname@gmail.com, I often get mail for someone else forenamesurname@gmail.com. I noe have no idea who else they are routing email intended to the former.

Older discussion: https://news.ycombinator.com/item?id=16781959

I have a first.last@gmail address from the beta, and after numerous misunderstandings I've learned to use very precise language when attempting to help:

First establish that they're speaking to the wrong person.

Then suggest the nature of their mistake is a simple omission of a letter or number.

never offer a 'no big deal' or de-escalation until they've acknowledged the problem, otherwise the real recipient will never get the email!

Reply with this - people are less likely to argue if they think you are a robot:

This message was created automatically by mail delivery software. A message that you sent has not yet been delivered to one or more of its recipients after more than 24 hours on the queue on mail.example.com.

The message identifier is: 1JYIJ1-0008Ew-JK

The date of the message is: <date>

The address to which the message has not yet been delivered is: <your email>.

oh I did try that approach! it was generally ignored completely except for one hilariously angry person.

It also disregards info after a + like:

validemail+ignored@gmail.com

You can sign up for sites like:

validemail+facebook@gmail.com

and it will still reach your inbox fine but be very obvious if your info is sold or stolen.

I spent far too much of my time trying to explain this to Humanity.com’s support after someone created an account using a dotless variant of my email. I didn’t want to freeze the guy out of his account as I imagine he was using it for shift work notifications but in the end they just told me to change the password. Their support repeatedly insisted that gmail was broken and I should contact Google.

I don't understand your problem. So Humanity.com made two accounts which both sent mail to the same gmail account, right? In that case it is easy to ignore or mark as spam or go to forget password and close the second account.

Because this is really Google's problem. If someone gives you an email address you're not supposed to touch anything before the '@' and assume that if the inboxes aren't exactly identical then they are separate addresses. Because on some (most) mail servers they will be separate.

Humanity is guilty of not actually verifying ownership/control of the inbox before letting the person attach it to their account but they were absolutely right to treat it as a separate address.

Obviously. My issues is the difficulty in explaining this to tech support even when confronted with evidence.

It's also an old trick that people do in order to create a lot of accounts on websites (typically for malicious reasons) without having to create many disposable email. They use a combination of periods and plus signs in the email label. On top of that they can use the alias googlemail.com instead of gmail.com to create more accounts on websites.

Glad to know I'm not alone in being a john.smith@gmail.com and receiving emails for johnsmith@gmail.com. For a while I was concerned there was some issue where there was an existing johnsmith@gmail.com before I created mine and gmail just fused them. But it seems more likely whoever this other johnsmith is, they just think they have this email.

I created my Gmail account as firstname.lastname@gmail.com (by mistake), but I always create accounts on website using firstnamelastname@gmail.com.

As a result, I often have problems when communicating by email with companies, as they can't match origin of the email (firstname.lastname@gmail.com) to my account email (firstnamelastname@gmail.com).

You can change your default "from" and "reply-to" addresses:

https://support.google.com/mail/answer/22370

Except for when it does matter! GSuite accounts do care.

first.name@company.com is a different address than firstname@company.com.

I learned that one the hard way.

Yes the article mentions as an admin you could remove the dots but they always matter.

I receive incorrect email daily because of this. Early adopter problem for early Gmail users. I could have had my first name at Gmail back in the day but I thought “what’s wrong with Hotmail!?”. Same thing for Twitter, but I still don’t use Twitter. I could have probably sold it for a pretty penny though. Hindsight!

That's pretty useful for giving out to sites that believe you can't have a + in your email, but you still want to track who the address is shared with. Does anyone know if you can make different filters for differently dotted versions?

I used this to get cheap dreamhost service back in the day by signing up once with my email with the dot and once without the dot. I now use the account without the dot permanently and it always throws me off. Worth it for the 1 year of savings :)

I have about 3 people sharing my Gmail Address to their banks, credit card, insurances, etc.

I use a similar behavior with the plus symbol to identify who leaks me email address.

Good. So I can re-subscribe to the same tryout service again and again adding dots to my address without the need of use disposable mailbox (banned for sure) or create a new one time address.

I have been getting private data and private documents of people with my same name because of this moronic feature.

And I can't trust Gmail anymore because of this.

I got a bunch of mortgage documentation for another person with my name (i assume they either are a 1-t brett (or a misheard brent, brad or brit) or their email contains their middle initial or someone misheard their last name over the phone ( there are several spellings for my last name that are more or less homophones ).. either way I now have enough information to easily steal their identity.

I feel like most, majorish, online services do email verification, but when you are giving your email address to a someone over the phone, that's where most of the problems start.

> Your Gmail address is unique. If anyone tries to create a Gmail account with a dotted version of your username, they'll get an error saying the username is already taken.

Well then I'd like to know how someone keeps signing up for services with my address, even though I never click any confirmation links. The email used for signing up specifically differs from mine by a dot.

(Though I don't think I'll complain to Google, seeing as it's just a dedicated address for shady sites, it's free, and Google aren't known for answering complaints anyway.)

> Though I don't think I'll complain to Google

Don't. Google has nothing to do with it. Complain to the services/companies sending e-mails to unconfirmed addresses. It is unfortunately fairly common.

The reason is because those services don't use an email confirmation process, either because they don't know better, or because they are email marketers who are happy to have every address that they can get and don't really care who gets their mail (the email equivalent of writing "OR CURRENT RESIDENT" on postal mail)

Fun Fact: Dots DO matter in gmails search bar:

from:<some email>@gmail.com and from:<some>.<email>@gmail.com return different results.

If someone emails you without a dot and you reply from your dotted address, it will look strange in the receiver's email client.

Depends on the client–the ones I use understand that people can reply back with a different address than the one I sent an email to. (I frequently see @cs.university.edu → @university.edu, or @gmail.com → @companyname.com.)

This has only recently been a problem for me. There is a nice gentleman with my same name who picked up the gmail address without the dot. He lives in Arizona. Has a library membership. Plays in a softball league. I am not sure how much of my email he gets. I haven't set up a filter yet but I will eventually. I like seeing what my doppelganger is up to some times.

No, he did not "pick up" that address. Google won't issue a second address that matches the concatenation of the characters without dots. So, if I have john.smith@gmail.com, Google will not issue anyone else johnsmith@, j.ohnsmith@, joh.nsmith@gmail.com or any other combination to another user.

What does often happen is that people FORGET what their actual email address is when they hand it out to other people or write it down on forms. Or their friends or family mis-remember it. Your doppleganger may have actually been issued the address johnny.smith, or smith.johnny, but just forgets.

Cool, so that means we all have infinite variations of our email addresses.

yeah I've known and used this forever to trace sources of spam, etc

You can add memos as well: jdoe+ExampleMemo@gmail.com

I have an uncommon last name, and picked an uncommon handle, so most of my accounts never get misaddressed e-mails.

But when I was younger and more foolish, I opened a mail account with a flippant phrase as the handle, and apparently somebody used that phrase as a "fake" e-mail address when signing up for the Trump campaign mailing list.

One thing I'm learning from that deluge of e-mails is that, no matter how little I think of GOP voters, I cannot manage to treat them with the utter contempt that the presidential family is treating them with.

not 100% true, gmail won't allow you to send to john....smith@gmail for example

That's got more to do with gmail's composer than with their mailer. "foo + bar@baz"@domain.net is a valid email address but gmail won't permit you to type it in.

john.....smith@gmail.com is not a legal email address: the local-part is a dot-atom (or quoted-string) production, so successive dots are not legal outside of a quoted string.

cool so johnsmith@gmailcom works? nice!

That’s not always true. I’ve sent an email from not Gmail service, it returned the non-exists error

I got an email from Australia with the appointment for my spousal visa application, I'm also apparently looking for a new BMW in Cape Town and I also have a partner I visit in Paris and we order Chicken McNuggets on Uber Eats.

Then why did they allow someone else to create an email like mine without the dot and I even get the occasional mail addressed to them. This is really shady, specially for an important service like email.

They didn't. You get email because somebody either typo's their similar address or they simply think that's their address when it isn't.

Not sure, I contacted this person, since I got their phone number from one of their emails (e.g. they registered for a hotel). I specifically asked them if they made a typo, according to them they have been using this email for years (maybe they lied but why would they).

This is inconclusive test, and if you ask people whether they made a mistake in the signup, they will likely answer no. Try to send a mail to that account, and if you receive a reply that is a real test.

Either that email address sends mail to your inbox or theirs - there's no way it could be some mix of the two.

They might have just been using it in terms of giving it out as theirs for years. Doesn't mean they've ever had access. Or they could have typoed it a long time ago and now actually think that that they've logged in with it when they never have.

They aren't lying, just confused. They probably made a hotmail.com account and assumed it would work with gmail.com.

I think you are assuming someone else should have created that email address without the dot because you are getting emails addressed to someone else. The reality is it is more likely that someone who hasn't created that email is using it as their address because they don't really understand how email and email addresses work

PREACH. This is hands-down the single largest reason why I abandoned my Gmail. I receive countless people's credit applications, loan details, new credit card details, bills, etc, credit collections, etc.

All because they have the same last name as me and opted to use a period in their email address.

This is happening across multiple countries as well. Sadly, none of these people ever receive their important messages because I gave up trying ages ago.

How they continue to explain this away as a feature is beyond me. Google is constantly pushing forward with various, and perhaps superficial, security/privacy oriented initiatives yet here's one of their core products offering up the most private details of others without zero care to fix it. SMH

I don't know how this would happen under their policy.

> Adding dots doesn't change your address, so dots aren't why you got someone else's mail. Instead, the sender probably mistyped or forgot the correct address.

> For example, if someone meant to email john.43.smith@gmail.com but typed john.smith@gmail.com, the message went to you because you own johnsmith@gmail.com.

This type of stuff happens all the time. I’m actually receiving all kinds of internal information from a large insurance company from India, supposedly because one of their employees is registered with a typo in the domain name, which is my domain.

I can’t for the love of god make clear to these people that there must be a dozen laws this violates. I see insurance application, invoices, disputes, everything on at least a weekly basis.

I have no idea what my legal position in this is. I tried reaching out to the senders, but I am afraid of reaching out to the C-levels directly because who knows how they respond.

Bottom line, people make typos all the time, and it’s not just dots that cause this. People are just terrible at email and email is terrible for sensitive documents.

I still get occasional emails for `firstnamelastname@gmail.com` while I registered `firstname.lastname@gmail.com`

Which seems to contradict what the article says, since the article suggests anyone who registered my `firstnamelastname@gmail.com` would own mine.

Or is the article suggesting actually nobody ever registered `firstnamelastname@gmail.com` and some idiots just think "oh i need to write to firstname lastname" (one of many who share my firstname/lastname in French) and they just compose that email address? I don't get it.

edit: but moral of the story I think it's really a bad idea to register based on a real firstname/lastname -- I'm tired of getting junk ... and worse, getting invoices for other people for a service I also use. I got confused once and actually made a payment which was not meant for me >_>

Yes, "nobody ever registered `firstnamelastname@gmail.com". You own it.

I keep getting email without dots because I too have common name someone mistakenly sends to.

> Which seems to contradict what the article says, since the article suggests anyone who registered my `firstnamelastname@gmail.com` would own mine.

It doesn't. firstnamelastname@gmail.com is also your address. Nobody could have registred it.

> Or is the article suggesting actually nobody ever registered `firstnamelastname@gmail.com` and some idiots just think "oh i need to write to firstname lastname" (one of many who share my firstname/lastname in French) and they just compose that email address? I don't get it.

Yes, that's what is happening. If you get unintended emails, their intended destination is yet another address.

Reply on news.ycombinator.com