Normalization

email is the canonical email: different spellings of one inbox give the same value. Put a unique constraint on it and a person can no longer open several accounts with aliases of one address.

Rules per provider

Provider	Rule	Input	email
Gmail	drop +tag, drop dots, googlemail.com → gmail.com	[email protected]	[email protected]
Outlook	drop +tag, dots matter	[email protected]	[email protected]
Yahoo	drop -keyword (Yahoo disposable addresses)	[email protected]	[email protected]
iCloud	drop +tag, me.com and mac.com → icloud.com	[email protected]	[email protected]
Proton	drop +tag, drop . _ -, all domains → proton.me	[email protected]	[email protected]
Fastmail	drop +tag, subdomain addressing	[email protected]	[email protected]
Google Workspace	drop +tag on any domain whose mail is hosted by Google	[email protected]	[email protected]
Privacy relays	lowercased only, each relay address is a distinct inbox	[email protected]	[email protected]
Any other domain	lowercased only, + and dots kept (the domain owner decides)	[email protected]	[email protected]

Domains covered by each provider:

Provider	Domains
Gmail	gmail.com, googlemail.com
Outlook	outlook.*, hotmail.*, live.*, msn.com, passport.com, windowslive.com
Yahoo	yahoo.*, ymail.com, rocketmail.com
iCloud	icloud.com, me.com, mac.com
Proton	proton.me, protonmail.com, protonmail.ch, pm.me
Fastmail	fastmail.*, messagingengine.com, sent.com

Google Workspace is detected from the domain's MX records with one DNS lookup. If that lookup fails, the address is returned lowercased only.

warning

email is a duplicate-check key, not always a mailbox. Send mail to the address the user typed: see Two addresses, two jobs.

Subaddressing (+tags)

A +suffix is not a sign of a fake address. It is a standard feature called subaddressing: Gmail, Outlook, iCloud, Proton, Fastmail and Google Workspace let every user add +anything to their address, and the mail still arrives in the same inbox. People use it to sort mail or to see who shared their address ([email protected]).

So an address with a +tag is a working address: disposable is false and deliverable is true. Recognizing the alias is the job of normalization, which removes the tag:

// POST /v1/check {"email":"[email protected]"}
{ "email": "[email protected]", "disposable": false, "deliverable": true }

Because email is the same for every alias of one inbox, you can use it to:

• Block duplicate signups. A unique column rejects [email protected] when [email protected] already has an account.
• Block banned users from coming back. If [email protected] is banned, every alias of it normalizes to [email protected] and matches the ban. Keep banned accounts, or at least their canonical email, instead of deleting them.

On custom domains other than Google Workspace, + and dots are kept, because only the domain owner knows whether they matter.

Yahoo disposable addresses

Yahoo has a feature called disposable addresses. Despite the name, these are not throwaway addresses: they deliver to the user's real inbox.

1. A Yahoo user with the account [email protected] turns on disposable addresses in Yahoo Mail settings.
2. Yahoo asks them to pick a base name once, for example ab. The base name is separate from their login.
3. They can then hand out any number of addresses made of base name, hyphen and keyword: [email protected], [email protected], [email protected].
4. All of them arrive in Maria's real inbox.

Signitize answers:

// POST /v1/check {"email":"[email protected]"}
{ "email": "[email protected]", "disposable": false, "deliverable": true }

• disposable: false and deliverable: true, because the address works and reaches a real person.
• email: "[email protected]", because the keyword is dropped. ab-shop, ab-news and ab-yoursite collapse to one value, so Maria can't open three accounts with three keywords.
• [email protected] is only the duplicate-check key: mail sent there may not arrive. Send the verification email to [email protected].

Invalid after normalization

An address with nothing left after normalization, such as [email protected] or [email protected], is rejected with 400, like any other invalid address. At a Google Workspace domain ([email protected]) this is known only after the MX lookup.