TECH Signal 501
Gmail ignoring dots in usernames reportedly causes some legacy account holders to receive others' email
↗
Illustration only Photo by Andreas Pajuvirta on Unsplash
A blog post argues that Gmail's policy of treating dotted and dotless variants of an address as equivalent may cause early account holders to receive email intended for users with the dotless version of their username.
For engineers building systems that depend on email as a reliable identifier, this illustrates how a provider's interpretation of RFC 5321 local-part semantics can create silent address collisions. The issue appears isolated to Gmail's implementation and affects a subset of legacy accounts, but it undermines assumptions about email uniqueness.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Gmail treats [email protected] and [email protected] as the same address, citing RFC 5321's requirement that local-part semantics be assigned by the host.
A Stack Exchange user reports receiving email for a dotless variant of their address despite having registered the dotted version years earlier, with only a portion of mail leaking across accounts.
The author speculates the behavior stems from a later Gmail change to ignore dots that may not have applied consistently to legacy accounts.
THE READ
What the cluster adds up to.
Gmail apparently changed at some point to ignore periods in the local part of addresses, treating [email protected] and [email protected] as equivalent. The author, an early Gmail account holder, reports receiving emails intended for other people named Sean Conner who hold the dotless variant of the address. The author notes that when they signed up, the dotted and dotless forms may have been considered distinct addresses.
The technical basis cited is RFC 5321 section 2.3.11, which states that the local-part of an address must be interpreted and assigned semantics only by the host specified in the domain part. Gmail leans on this to justify ignoring dots, but the author questions whether this was always the case or a later change that may not have been applied consistently to accounts created before the shift.
A commenter on Lobsters linked to a Stack Exchange answer from a user who reports receiving email for a dotless variant of their address despite registering the dotted version roughly ten years before the other party. That user claims to have contacted the other account holder and confirmed both accounts exist, with only a portion of email leaking across them. Google reportedly insisted that no programming mistake was possible.
The practical consequence is that early Gmail users with dotted addresses may receive sensitive correspondence such as bank notices and school communications intended for others. The author states they no longer use Gmail for important or confidential matters as a result. The issue appears specific to Gmail's implementation and does not necessarily generalize to other email providers.
The discussion originated from a Lobsters thread about a researcher who bought noreply.net and received secrets from companies. The author's comment about their own experience generated extensive discussion, suggesting that email misdelivery due to address confusion is more widespread than commonly assumed. The material does not establish how many users are affected or whether Google has addressed the issue.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER