What is multi-accounting?
Multi-accounting is one person creating many accounts on the same service, usually to repeat a signup benefit. It is trivial because most providers treat several different-looking addresses as the same mailbox: Gmail ignores dots, most providers ignore anything after a plus sign, and both variants deliver to the same inbox.
Written by the SieveGuard team from the checks our own free tools run. Last reviewed .
Why one mailbox produces unlimited addresses
Two conventions, both entirely legitimate and both widely supported, mean a single inbox answers to an unbounded set of addresses. No tooling required — a person can type these.
| Convention | Example | Delivers to | Supported by |
|---|---|---|---|
| Plus-addressing | name+shop@gmail.com | name@gmail.com | Gmail, Outlook, Fastmail, Proton, most modern hosts |
| Dot-folding | n.a.m.e@gmail.com | name@gmail.com | Gmail only |
| Domain alias | name@googlemail.com | name@gmail.com | Gmail |
| Case | Name@Gmail.com | name@gmail.com | Everyone — the domain is case-insensitive |
Dot-folding is the one that surprises people, and it is Gmail-specific. Combine it with plus-addressing on an eight-character local part and one mailbox yields well over a hundred distinct-looking addresses that all arrive in the same place.
all of these reach exactly one inbox: jane.doe@gmail.com janedoe@gmail.com j.a.n.e.d.o.e@gmail.com janedoe+signup@gmail.com jane.doe+trial2@googlemail.com JaneDoe@Gmail.com
Canonicalisation: collapsing them to one key
The defence is not to block these addresses — plus-addressing is a good practice used by careful people. It is to compute a canonical mailbox key and recognise that six signups map to one of them.
The steps, in the order they must run:
- Lowercase the domain. Always safe — domains are case-insensitive by specification.
- Map known domain aliases.
googlemail.com→gmail.com. A short list, not a general rule. - Strip the plus tag — everything from the first
+to the@— for providers that support it. - Remove dots from the local part, but only for Gmail. This step is wrong everywhere else.
- Lowercase the local part for providers that treat it case-insensitively, which in practice is all the major consumer ones.
jane.doe+trial2@googlemail.com ↓ lowercase domain jane.doe+trial2@googlemail.com ↓ alias → gmail.com jane.doe+trial2@gmail.com ↓ strip +tag jane.doe@gmail.com ↓ remove dots (Gmail only) janedoe@gmail.com ↓ lowercase local janedoe@gmail.com ← canonical key
Store the canonical key alongside the address the user typed. Send to what they gave you; count uniqueness on the key. That distinction is the whole design — canonicalising for delivery would break the plus-tag filters people rely on.
Where step 4 goes wrong
Dot-removal is the step most implementations get wrong, and the failure is silent and expensive: two genuinely different people collapse into one account.
| Address pair | Same mailbox? | Why |
|---|---|---|
j.smith@gmail.com / jsmith@gmail.com | Yes | Gmail folds dots |
j.smith@outlook.com / jsmith@outlook.com | No — different people | Outlook treats dots as significant |
j.smith@company.com / jsmith@company.com | No | Corporate domains almost never fold |
a+x@gmail.com / a+y@gmail.com | Yes | Plus tags are universally strippable |
Rows two and three are the ones that cost you. Applying Gmail's rule to a corporate domain merges j.smith and jsmith — plausibly two colleagues — into a single identity, and they then cannot both hold accounts. Dot-folding must be gated on the provider, never applied globally.
What canonicalisation does not catch
It closes the free variants. Someone willing to spend a little more has other routes, and being clear about the ceiling is more useful than implying there isn't one:
- Genuinely separate mailboxes. Five real Gmail accounts are five real mailboxes. No address-level analysis will merge them.
- Disposable addresses. A different problem with a different defence — the domain, not the local part.
- Their own domain. Anyone with a catch-all domain has unlimited genuinely distinct addresses, and they are indistinguishable from a small company's staff.
Which is why address canonicalisation is a first layer rather than the answer. Beyond it the signals are behavioural — timing, near-duplicate local parts across different domains, shared device or network characteristics — and clustering those is what catches the cases canonicalisation cannot.
Not everything that looks like this is abuse
Plus-addressing is good practice
Using name+yourservice@ is exactly what the convention is for: it lets someone filter your mail and see who leaked their address. Treating it as suspicious punishes your most careful users.
Shared mailboxes are normal
Several signups from a role address usually means several colleagues, not one person twice.
The right response is rarely a block
Detecting that six accounts share one mailbox is useful information. Refusing the signup outright turns a false positive into a lost customer with no recourse. Limiting the benefit to one per canonical mailbox — one trial, one discount — gets the outcome without that cost.
Sources
FAQ
What is multi-accounting?+
One person creating multiple accounts on the same service, usually to claim a signup benefit more than once. It is easy because most providers deliver several different-looking addresses to the same mailbox, so the accounts look unrelated in your database.
Does Gmail really ignore dots in email addresses?+
Yes. jane.doe@gmail.com and janedoe@gmail.com are the same mailbox, and so is j.a.n.e.d.o.e@gmail.com. This is Gmail-specific — Outlook and virtually all corporate domains treat dots as significant, so applying the rule everywhere merges genuinely different people.
Should I block plus-addressing at signup?+
No. It is a legitimate convention that lets people filter mail and identify who leaked their address, so blocking it punishes your most careful users. Strip the tag when computing a uniqueness key, but keep the address they gave you for sending.
What is email canonicalisation?+
Reducing an address to a single key representing the underlying mailbox: lowercase the domain, map known aliases, strip the plus tag, remove dots for Gmail only, lowercase the local part. Six variants collapse to one key, so you can count uniqueness correctly.
Can canonicalisation stop all multi-accounting?+
No, and it is not meant to. It closes the free variants of one mailbox. Someone with five real accounts, or their own catch-all domain, has genuinely distinct addresses that no address-level analysis will merge — those need behavioural signals instead.
Should I block accounts that share a canonical mailbox?+
Usually not. Blocking turns a false positive into a lost customer with no recourse, and there are innocent explanations. Limiting the benefit rather than the account — one trial or one discount per canonical mailbox — achieves the goal without that risk.
Check it on a real domain
Free, no signup, DNS-only. Nothing you type leaves the lookup.