The use of a plus sign
+ in an email address is a useful feature. Gmail, as well as many other mail providers will deliver mail addressed to
[email protected] as though it were addressed to
+tag portion of the email address can then be used both for purposes like registration and filtering emails into the inbox.
It's very useful when a user is trying to find out the source of spam emails and can use it to block any future correspondence from the spam provider or organize the emails with Tags / Folders.
How can it be used in a malicious way?
The only way it can be used maliciously is by multiple sign-up spam or user registrations.
Most of the providers do have security measures to prevent signup spams from automated bots/scripts like: rate-limiting, captcha, etc. So, if you have these measures already in place, you are ok.
Should we forbid emails with + signs during registration?
It depends on the specific business use case. If it requires a user to register only once, you can check for it during registration and if an account already exists with any variant (
user<*>@example.com), then you might disallow this with something like:
"User already exists with that email."