Microsoft adding support for custom '+' email addresses in Office 365

https://www.zdnet.com/article/microsoft-adds-support-for-custom-email-addresses-in-office-365/

by crones • 6 years ago

136 123 6 years ago

I understand the appeal of this feature for sorting, but it seems ineffective for things like "figure out who sold my email to the spammers" because everyone knows about it and it's elementary to just trim off everything after the plus sign.

Unless you do some kind of verification and filter email sent to addresses without a valid suffix?

Traubenfuchs• 6 years ago

If bad actors cut off the +, fight back by not using your bare email at all: Provide everyone with a + address, ignore all emails that come without.

jeremiahlee3• 6 years ago

I would agree with this technique, but it’s not possible due to the high number of services that don’t permit “+” in the email address or break because they don’t URI encode it. I have several services I will never be able to unsubscribe from because of the latter—and yes, I tried manually URI encoding it and changing the form fields with dev tools.

iggldiggl• 6 years ago

Curiously enough, so far I've only ever observed the reverse happening - spammers somehow ending up stripping off the common prefix and leaving the individual suffix intact.

(Though on the other hand thankfully I'm still not getting much spam anyway and it's only a few addresses that were affected, so I only have a limited amount of data to go by.)

throw0101a2• 6 years ago

Hyphens and equals are other options that are supported by various services:

* https://en.wikipedia.org/wiki/Email_address#Subaddressing

Equals specifically is used by mailing list software (esp. Mailman) for bounce processing (VERP):

* https://en.wikipedia.org/wiki/Variable_envelope_return_path

giomasce• 6 years ago

Since I have my own domain, I receive all emails addressed at whatever@domain.com. Of course, different values of "whatever" end up in different directories, and should one of those display an insufficient SNR, it would go straight to /dev/null. This way the "proper" address, i.e., the one that goes to the actual inbox, is not easy to extract.

The hard part is social acceptance. This morning the Whirpool technician was very puzzled by me giving him whirpool@domain.tld as my email, although he accepted my explanations in the end. (I might use more opaque identifiers, but then I would forget about what is what, so for the moment I am trying to stick with this scheme, until it becomes too difficult)

smichel17• 6 years ago

I have the same setup, with not very many different directories (most just comes to my inbox), since my email load is pretty manageable. I find the most spam by far comes from an address checked in to a public git repo, with my actual (public) github email a distant second and everything else pretty much nil.

The only non-public email so far that has resulted in a lot of spam was the one I gave to the animal shelter when I adopted my cat. (I count unsolicited advertisements as spam.)

ACS_Solver• 6 years ago

I also have my own domain and use a similar setup, with some grouping, such as:

home@domain.tld is for anyone and anything dealing with my physical home. Delivery of an appliance, repairs, homeowner's insurance and such. I expect the email volume here to be low except when ordering something.

fly@domain.tld is for any flight reservations. That's pretty convenient, I can find any old tickets or travel details by filtering for this address, and I also know any incoming mail is likely an ad, unless I just bought tickets.

hotel@domain.tld is for all hotel reservations, and is even more convenient. Unlike flights, I never need any emails from hotels except to see that my stay has been confirmed.

And on the rare occasions I expect to need a throwaway email, I'll use somethingrandom@domain.tld and point it to /dev/null after receiving what I needed.

simpss• 6 years ago

The social acceptance part is truly hard. I recently received a BS trademark cease & desist because i was using the company name in the e-mail address I provided them & was using to communicate with them.

Personally, i've just replaced the recipient_delimiter default value(+) with "." as that is basically impossible to strip out. Ex, firstname.COMPANY@example.net

I do get a lot of weird looks when handing the addresses out in person, but a quick explanation usually works. I just tell them, that if I start receiving spam from one one the addresses, I can just block it and be done with it. They sometimes counter with "but we won't spam you" and I acknowledge that with "but not everyone is so nice as you" or something like that.

ps: you can use multiple delimiters, so grouping is possible with firstname.bills.COMPANY@example.net

ahalam• 6 years ago

FastMail had some of the cleverest ideas for plus addressing. username+tag@fastmail.fm could be given away as tag@username.fastmail.fm

snorremd• 6 years ago

I used this for a few sites, but then stopped as I realized this would be a pain to change if I ever wanted to change to a different email provider.

Wish every provider would support this as I’m sure spammers have caught on to the plus addressing scheme.

dsr_• 6 years ago

The majority of spam [that gets past various RBLs] that I receive is completely ignorant of the dash addressing that I use. It's exactly the same as plus addressing but with a dash instead of a plus.

Pharma spam, 419 scams, password leak crypto blackmail... remember that these miscreants rely on low costs to achieve their profits, so any sort of filtering is too expensive. They don't even filter out abuse@, postmaster@, hostmaster@, or mailer-daemon@.

tyingq• 6 years ago

This should work on gsuite, for example, if you use your own domain and set up a route for unknown users.

Shorn• 6 years ago

I run a paid service called Kopi (https://kopi.cloud) that is meant to deal with exactly this issue.

You can use a shared domain:`hackernews@snorremd.kopi.cloud` Or, after setting up an MX and a TXT DNS record, you can use your own domain: `hackernews@mail.snorremd.com`.

You can change the "real address" of any "forwarder" (`snorremd.kopi.cloud`/`mail.snorremd.com`) to relay to any address you want, whenever you want.

You can block individual addresses like `hackernews@mail.snorremd.com` with two clicks starting from your mail client.

You can also configure individual addresses to redirect to RSS so you can read newsletters or other "chatty" services as part of your normal browsing habits.

metaphor• 6 years ago

Why couldn't spammers just:

  s/(\w+)@(\w+)\.(fastmail\.fm)/\2@\3/g

...or equivalent?

kop316• 6 years ago

In that instance you can. What is also nice though is if you have a custom domain, you can set the custom domain to do the same thing AND have an alias.

So for me, I have a few emails in my custom domain:

{firstname}@example.com

market@example.com

(there's others, but it's not relavent to this discussion).

market@example.com just goes straight to spam, as I don't use that email for anything. foo@market.example.com is used for each email instance. It works out extremely well.

jeremiahlee3• 6 years ago

I really wish FastMail would add an option to use a minus instead of a plus since most forms properly handle minuses, but many do not properly handle pluses.

lawn• 6 years ago

Nowadays I just use tag@mydomain when I interact with websites.

cm21872• 6 years ago

Couldn’t agree more.

If the website is breached, the login isn’t a login for any other website, and advertisers have a harder time correlating your identity, and if you get spam you know who is the culprit, and you can stop the spam by deleting the alias.

With this, no need for any other antispam logic. Back to the mid 90s (which is a good thing as far as email traffic is concerned!).

paulie_a• 6 years ago

Now adays I simply don't care about spam. It goes in the spam box and is a wasted effort for the criminal

jph00• 6 years ago

I wrote that! I'm glad you like it. :)

It's been nearly 20 years since I added that feature. I assumed at the time everyone would do it when they saw how handy it is. For some reason that didn't happen...

kayson• 6 years ago

I use it too! It's fantastic

mynegation• 6 years ago

I used it, Jeremy. Since then I transitioned to sitename@mydomain.email but I still have quite a bit of legacy sitename@myusername.fastmail.fm

TeMPOraL2• 6 years ago

Thank you!

I use tagname@myusername.mydomain these days, and that's still my favorite feature!

glial• 6 years ago

Just heard about it today, and just started using it today! Any other cool tricks I should know about?

D-Coder• 6 years ago

Panix.com has a similar feature. If you are dcoder@panix.com, you can use <anytag>@dcoder.users.panix.com, which avoids the problem of places that don't understand "+". I usually use companyname@dcoder.users.panix.com for each company I deal with. (Note, I am not actually "dcoder".)

It's a little longer to read over the phone, but I've never had trouble with it. And I've been able to tell a couple of companies that their email databases had been hacked or stolen.

Disclaimer: just a satisfied customer.

throw0101a2• 6 years ago

Finally.

This has only been allowed since RFC 822 (1982). Is there any reason why Microsoft did not support this from the beginning (of Exchange)?

randunel• 6 years ago

I've been using "Microsoft 365" since 2012, outlook w/ a custom domain and all the grandfathered features. The +tag has always been supported, and I can't really tell what the difference between "Office 365" and "Microsoft 365" is, since the latter appears to include the former, if not identical.

thomasedwards• 6 years ago

Same as the difference between a Microsoft account, a Microsoft Passport, a .NET Passport, and a Windows Live ID.

scohesc• 6 years ago

Microsoft recently renamed a majority of their products yet again because if it wasn't confusing enough already, it's even more confusing now!

"Microsoft 365" now includes all of Windows 10, Office 365 (Office on PC) and Azure. This is more geared towards the home market.

Then, there's "Office 365 for Business" which as the name implies is more for business/corporate customers.

It looks like your custom domain is using the old Outlook.com/Hotmail architecture, which already supported +<tags> in email addresses - while Microsoft's corporate offering (running on a cloud based Exchange Server) still doesn't, and they're pushing support for it out later this year.

poizan42• 6 years ago

Exchange was originally an X.400-based groupware system, SMTP support was somewhat of an afterthought. Exchange has a long history of not implementing SMTP properly with protocol violations and proprietary payloads (TNEF) and headers (e.g. Thread-Index)

OliverJones• 6 years ago

1982? Back then Microsoft's attitude toward the Internet was "embrace, extend, and suffocate." It made little sense for them to work with the nuances of standards, according their business model back then.

I have added this capability to every commercial web property I've worked on.

inetknght• 6 years ago

Back then Microsoft's attitude toward the Internet was "embrace, extend, and suffocate."

I'm pretty sure that's close to Microsoft's current attitude towards the Internet.

lucb1e2• 6 years ago

I have added this capability to every commercial web property I've worked on.

I tried doing email validation the modern way: if '@' in emailfield then return True else 'email address needs an @'. The user gets a confirmation email anyway, and the sign-up process was literally name, email, tick a box that you read the privacy policy, and click continue, so they can just re-do that if they typo'd the address.

Iirc the boss decided to set requirements for a regex that I was to implement instead. Or maybe he made the regex and I tweaked it saying "this won't match .amsterdam domains", not sure anymore.

Markoff2• 6 years ago

their Outlook.com has this for years, I'm surprised O365 didn't have it

frandroid3• 6 years ago

outlook.com is an extension of hotmail.com, whereas O365 is built onto Exchange...

chrismorgan2• 6 years ago

No it hasn’t. RFC 822 essentially says “local-part is whatever you want it to be” and defines no semantics. Certainly it doesn’t say “you can put a plus on and anything after that will go to the same mailbox”. That’s a far more modern notion, and one that is far from ubiquitous. Rather, it says things like this:

The local-part of an addr-spec in a mailbox specification (i.e., the host's name for the mailbox) is understood to be whatever the receiving mail protocol server allows. For example, some systems do not understand mailbox references of the form "P. D. Q. Bach", but others do.

curiousgal• 6 years ago

They should just fix searching in Outlook web instead.

m0xte• 6 years ago

LMAO so true. The search is beyond dire. Not much better on the desktop either.

Hnrobert42• 6 years ago

Now if only websites will stop rejecting plus-addressed email addresses as invalid. The most frequent offenders are mom & pop websites that you just _know_ are going to get breached.

beagle33• 6 years ago

That's not going to help, since everybody knows you can just strip everything after the '+' and get to the main mailbox.

Already__Taken• 6 years ago

Jokes on them, if my spam+<tag> doesn't have a tag it's straight in the bin.

hawski2• 6 years ago

I do prefix+12RandomLetters@blahblah and every potential sender gets it's own random address. Then I use filters to move mail to predefined folders. What's left is spam.

If a mail comes in from an unknown sender to known address I know that the address is compromised.

Ideally I would like to plug my password manager to generate an address and automatically add email filters in place.

Although I was thinking about a service that would just give randomalphanumeric@example.com for all its users, so they would be on the same host and no connection between addresses could be implied. It could or even should be receive only.

kevin_thibedeau2• 6 years ago

'+' has no standardized meaning. Just put the tag first and let them strip off the unimportant part.

amf12• 6 years ago

You can also use this with a "." (email.spam@gmail.com) in Gmail.

PetahNZ• 6 years ago

No, you cant.

LandR• 6 years ago

This doesn't work for me

bar.foo@gmail.com

gets rejected as email address doesn't exist when my gmail is bar@gmail.com

inanutshellus4• 6 years ago

Periods are ignored in gmail and anything after a + is also ignored, so all of these will go to the same mailbox:

   johndoe@gmail.com
   john.doe@gmail.com
   j.o.h.n.d.o.e@gmail.com
   johndoe+spam@gmail.com
   john....doe+spam@gmail.com

but johndoe.spam@gmail.com wouldn't go to the same mailbox.

jacobr1• 6 years ago

Gmail lets you add "." in arbitrary places, but not to append additional text.

For example: foobar@ foo.bar@ f.o.o.b.a.r@ are all valid and normalize the case without the periods.

ascagnel_• 6 years ago

Periods are handled slightly differently than "+" characters in Gmail -- periods are ignored (so an email to email.spam@gmail would be delivered to emailspam@gmail.com), while everything following a + would be delivered (so email+spam@gmail.com will be delivered to email@gmail.com).

frandroid3• 6 years ago

It is indeed a good way to filter out _all_ email...

isoprophlex3• 6 years ago

I use shopname@firstname.lastname.email, with my own lastname.email domain. Fastmail makes configuring your dns records for this super simple.

It's always fun interacting with customer service reps when they for example confirm my email address... "errrrrr yeah so we email you at ourname@...?"

jnwatson• 6 years ago

I've done that for nearly twenty years now. Importantly, it allows one to trace how your email gets distributed and stolen.

lozaning• 6 years ago

I own fakefakefake.email and savor the opportunity to give people dumb catchalls when they insist on needing an email address from me.

fisherjeff• 6 years ago

Wow I have the exact same setup – it works perfectly! I assume you also, like me, have a backup domain like lastname-email.com for all the broken email validators out there?

Forge36• 6 years ago

I like this! I haven't used my own mail-server for much, however this is a great way to avoid a single "e-mail" that everyone can support :)

noja2• 6 years ago

Why do you use shopname@? Once you know the pattern everyone can guess it.

TeMPOraL2• 6 years ago

Oh yes, and also in physical stores when e.g. giving a contact e-mail for warranty updates.

- "Oh! You work with us? At which store?"

paledot2• 6 years ago

The other problem I ran into is spam+sitename@mydomain.com is really awkward to read over the phone. I ended up switching to sitename@email.mydomain.com, which passes all validators and doesn't sound as sketchy. Using a subdomain, I don't seem to catch any of the spam that gets targeted to catchall domain addresses.

Also, I once encountered a site where spam+xyz worked for signup but failed validation on the login form. I think it was something important too, like a utility or bank.

Terretta• 6 years ago

The worst is when it doesn't fail signup, but URL-Decodes into a space in their data.

flingo• 6 years ago

I've done that, and gotten banned from a site later for having the company name in my email. (I was unbanned later, after contacting support)

mrlala• 6 years ago

Odd that you are talking about security breaches with this..

I figured sites wouldn't want to accept it because they know you are most likely filtering their emails so they have a much less chance of getting through to you.

If someone is stealing emails/passwords from a site obviously they will just strip characters after the plus to obtain your normal email address?

6c696e7578• 6 years ago

I use qmail, where - has been the extension for, well, since it was created. If you're a postfix person, you can use + or -, with recipient_delimiter.

You're less likely to bump into issues with -.

Some shops don't like their trade name in the email, so rot13 (g? in vim) solves that if your goal is to trace back the leaks. I have not found a reliable way of auto dropping mail from bad sources, sometimes companies change name which makes it hard to validate From with recipient.

aclindsa• 6 years ago

If you're a postfix person, you can use + or -, with recipient_delimiter.

Even better: postfix and dovecot (as of v2.3) now both allow specifying multiple recipient delimiters. So if you run your own mail server you can specify as many recipient delimiters and switch between them if websites are being picky.

gumby• 6 years ago

I simply changed my mail configuration to use a different character, in my case _ though X would have worked as well.

I wish seive were better supported in mail clients. It works fine on the back end, but I edit my .seive file by logging into the server and sparking up Emacs rather than being able to handle it directly from my mail client.

girzel• 6 years ago

Emacs can be used to edit sieve files directly on the server, with M-x sieve-manage, so long as you have the managesieve daemon running.

parliament32• 6 years ago

I use the managesieve plugin in claws-mail, works great with no issues.

cm21872• 6 years ago

It reminds me a gag from the last season of What we do in the shadow. A character puts a toothpick on his lip and suddenly none of the other characters recognise him.

Like if spammers and hackers were not aware of the + notation, and like if it wasn’t trivial to extract the underlying email address by removing anything after the +...

Unless you have an alias that completely obfuscate the underlying email, I just don’t see the point.

scarface74• 6 years ago

I agree. But there are other corner cases where that would be helpful. I’ve worked at a lot of software as a service companies where your email address has to be unique per client for a multi tenant system.

We would create different users for different roles. I would love to be able to use one email address distinguished with a tag.

snielson• 6 years ago

I use these all the time with my outlook.com account (and Gmail before that). You are right that they don't help with spam. However, they add an extra layer of security because now my logins have both a unique email address and password. Of course, a password manager is mandatory.

tmaly• 6 years ago

I found out this was a bad idea to use when I used it with gmail to signup for AirBnB. I had forgotten that I used it.

I created a new account without it, but I could not bring over my past reviews.

altreality2050• 6 years ago

They had to. This was the only reason why people would refuse to migrate from GSuite to Office365.

donmcronald2• 6 years ago

I'd rather have a properly supported catch-all than + addresses.

techntoke• 6 years ago

I don't think it is the only reason. Labels in Gmail are still really nice. Microsoft Outlook rules will often duplicate messages and smart folders using search filters don't work between browser and email client. Using IMAP they are simply virtual directories like they should be.

Microsoft Calendar is also pretty bad too. Like in a large organization you'll often have people leave the company. When you delete a series in Outlook with multiple people it tries removing the history for everyone which is important dates. There are a lot of nuances that would prevent me from ever switching to Office. Even OneDrive is tied to SharePoint and it is way too easy to break.

inanutshellus4• 6 years ago

The process for sending email /from/ a + address is tricky.

First -- in GMail at least -- you have to explicitly set up a + account as being in your list of "from" accounts and then you have to remember to use it every time you reply!

Not to mention forgetting the email I gave them when resetting passwords sucks, too. "Was that foo+hn or foo+ycombinator or foo+ycombinator.com or foo+hackernews or... hm... uhhh..." (You need a centralized password manager, in other words.)

I've had several issues where I've replied and sending from the base-address means the conversation goes awry ("We don't recognize this email address"), or at best I still expose the base address because I only remember to reply using the laboriously-created-from-plus address about a fourth of the time.

paledot2• 6 years ago

Good point, I've been meaning to make this a feature request in ProtonMail.

donmcronald2• 6 years ago

You can't even send from a normal alias in Office 365, so I'd be shocked if you'll be able to send from these '+' aliases.

inanutshellus4• 6 years ago

Wow, that sucks.

I honestly don't see how that would work. Like, how would you unsubscribe to a mailing list? Most these days let you click a link rather than reply with "unsubscribe" but still...

I've had multiple occasions where contact /to/ a business needed to come from the email address I used to sign up with their service (automatic correlation to users I guess).

One particular exchange was particularly painful. Every email I sent was, I assume, routed to a new customer queue. Every email that I sent from my non-+ alias was delayed by days and then dealt with by an unhelpful "we don't recognize this email address".

It was very painful and it was all because I used a + alias as my supplied email address but kept forgetting to use it as my 'from' address.

Had I not had the ability to set it as my 'from' I'd probably have stopped using + aliases entirely.

RcouF1uZ4gsC• 6 years ago

I think if you have the means, you should always get a custom domain for your email address. Your email address is the key to your online identity. You should own it, and not lease it from someone else.

And it is not like you have to manage your own email servers. You can use services like fastmail or any number of email providers to receive email on your own domain. You also have the ability to change your implementation without changing your address. You can decide to host it yourself, or go to another provider without having to tell all your contacts that you are changing your email.

It becomes trivial to actually give out email addresses that are customized for the service. Instead of me+service@hotmail.com you can give out service@mydomain.com.

In my opinion, the money you spend for your own domain for email, is well worth it.

etaioinshrdlu• 6 years ago

I had to normalize email addresses in my web service by removing "+..." because of spammy users. My god, spammers are often so obvious...

ahnberg• 6 years ago

Maybe they will get around to fixing their In-Reply-To header removal madness one of these decades too, would be something!

Tired of Microsoft users subscribed to mailinglists constantly breaking threading.

jasonv2• 6 years ago

I moved all my public emails from first@last.something to first.last@wellknownmailprovider

and then spent a lot of time changing my email address in accounts that I've had a really long time.

Shocked at how badly that went, actually. For certain service providers, I couldn't change my email address and was encouraged to open a new account, which would've meant losing certain records in the old accounts. I couldn't consolidate.

And companies that have different email addresses for their accounts and their mailing lists -- not helpful.

And finally, companies that disable the "update your email address" link in footer of popular email list services, so your only option is to unsubscribe -- good going (not).

DenseComet• 6 years ago

What was your reasoning behind moving your emails to a public email provider instead of an email with a domain you seemed to control?

I've been trying to move in the other direction and its been exactly as much of a pain as you've mentioned.

jasonv2• 6 years ago

There's a long story here, but here's the short take:

Most of my email accounts are public email provider mapped to domains. But anytime I sign-up for something that's not tied only to one of my work endeavors, I use the non-mapped address. So, newsletters, sign-ups, Amazon account, etc. I don't use any mapped domains for those things, as those kind of come-and-go.

I segregate my personal email and my business emails from the @public-email-provider address, which I want to keep away from my other activities. It also puts all those mailing list emails, legal acknowledgements, etc., in one place as much as possible. I can filter and manage those in one place.

I also don't have a strong sense of personal ownership of that stuff. It's like a PO Box, not my house address. I don't check that account for human- initiated communication. That's my personal address (which gets almost zero traffic these days) and my work/business email addresses.

I have a strong aversion to the company behind public email provider. But I set a calendar reminder for a year out so I don't think about it much until then. I have some endeavors that will let me close up various business activities and centralize to one. If/when that's solid, I'll probably consolidate all my income-oriented business accounts and services [and probably somewhere else], but keep the public... as it's just a PO Box.

CodesInChaos• 6 years ago

You could use such addresses already, but had to configure an address regex for each user.

hadcomplained• 6 years ago

I wonder why there are no email providers that offer an infinite number of aliases that cannot be associated with the primary address. Simply offering any aliases would soon fill out easy-to-remember addresses, but can't email providers offer a feature to add a randomly-generated address such as 098f6bcd4621d373cade4e832627b4f6@email.provider? This way, users can use a different email address on a different web service when registration, which would reveal no information about the user and drastically improve users' privacy. In addition, it is easy to track down which web service is at fault in the event of receiving spams via sold user data.

Microsoft adding support for custom '+' email addresses in Office 365

Related Stories