Gmail alias checker: is this the same inbox?

How Gmail aliases work: the official rules

Gmail documents its alias rules unusually well. A 2026 study that tested 28 email providers found that only Gmail fully documents its aliasing (Wu et al., NDSS 2026). The rules:

• Dots don't count. Mail to j.a.n.e@gmail.com reaches jane@gmail.com (Google: Dots don't matter in Gmail addresses).
• A + starts a label. jane+school@gmail.com is delivered to jane@gmail.com; Google suggests it for sorting mail (Google: Send emails from a different address or alias).
• googlemail.com is gmail.com. Messages to either domain go to the same place (Google: Getting someone else's mail).
• Case is ignored. Every provider in the NDSS study treated JANE@ and jane@ as the same address.

Stack them and J.a.n.e+trial7@GoogleMail.com is plain jane@gmail.com. The checker above applies these rules through canonicalize(), the function behind Vetto's repeat detection.

One alias no string rule can catch: Google now lets some users change their @gmail.com address. The old one becomes an alternate address that still receives mail, up to three changes per account (Google Account Help).

Why aliases break free-trial limits

Most signup code enforces "one account per email" with a unique index on the raw string. To that index, jane@gmail.com, jane+1@gmail.com and j.ane@gmail.com are three customers. All three pass email confirmation, because every message lands in the same real inbox. One Gmail account can farm as many trials as it likes.

This happens at scale. The NDSS researchers found one base address behind up to 139 npm accounts used for spam packages, and 9 of the 18 popular platforms they tested had no defense against aliases from any provider. For the wider playbook, see how to stop free trial abuse without a credit card.

Where normalization goes wrong

Google Workspace and other custom domains

Dots only disappear on consumer Gmail. On work and school accounts they are part of the address. Suped adds that you should not strip dots just because a domain's MX records point at Google (Suped). That is why the checker, like Vetto, removes dots only on gmail.com and googlemail.com.

Other providers

Plus-addressing is common but not universal: the NDSS study found 11 of 28 providers support + suffixes. Vetto strips +tags on every domain, which can over-merge on a provider that treats + as an ordinary character. Rules differ elsewhere too: Clerk's subaddress blocking also treats = and # as separators, plus - on Yahoo (Clerk docs). Vetto leaves hyphens alone, so jane-doe and jane-smith never merge. It also folds Proton's domains into proton.me (a paid Proton account can use the same name on protonmail.com and pm.me, per Proton) and Apple's older me.com and mac.com into icloud.com. Here is what the engine does, computed from the code:

Store what they typed

Keep the address exactly as entered for login and sending, and keep the key in a separate column used only for matching. Suped recommends the same, and warns against using the key as the only login credential or to merge accounts automatically. A minimal key function:

// Matching key for repeat-signup checks. Mirrors Vetto's canonicalize()
// for Gmail. Store the address as typed; compare on this key only.
export function aliasKey(email) {
  const e = String(email).trim().toLowerCase();
  const at = e.lastIndexOf('@');
  if (at < 1) return null;
  let local = e.slice(0, at);
  let domain = e.slice(at + 1);
  if (domain === 'googlemail.com') domain = 'gmail.com'; // same inbox
  local = local.split('+')[0] || local;                   // drop the +tag
  if (domain === 'gmail.com') local = local.replace(/\./g, ''); // consumer Gmail only
  return `${local}@${domain}`;
}

aliasKey('J.a.n.e+trial7@GoogleMail.com'); // "jane@gmail.com"
aliasKey('jane.doe@acme.io');              // "jane.doe@acme.io" (dots kept)

Warn, don't hard-block

A canonical match is a risk signal, not proof, as Suped's guide puts it. The same inbox can sign up twice for good reasons: an agency opening a second account for a client, a founder who forgot an old trial, a family sharing one address. Block them outright and you lose a customer at the moment they wanted to buy.

So Vetto warns on repeats by default: the visitor sees your message (say, "You already have an account. Sign in instead?") and a second submit goes through. On Pro you can set the action per site to allow, flag, warn or block. The NDSS authors recommend notifying the base address, as Facebook does by sending it a password reset when it spots a known alias. Pointing people to sign-in does the same job gently.

Catch repeat signups automatically

Vetto Pro runs this check on every signup and acts on it. It keeps salted hashes, never plain emails, uses them for 90 days of repeat detection and then purges them. When a new signup reaches an inbox it has seen, the verdict carries a repeat count, and the signed token passes it to your backend so you can enforce the rule server-side. The live demo is pre-seeded with jane@gmail.com and six aliases, so j.a.n.e+trial7@googlemail.com comes back with repeat 7.

<script src="https://usevetto.com/v.js" data-site="pk_your_public_key" defer></script>

On Free, alias detection runs in shadow mode, so your stats show how many repeats you would catch before you upgrade. To find alias clusters among the users you already have, run the free email list audit on a CSV export, right in your browser.

Other options: on Clerk, turn on subaddress blocking on its Protections page. On Supabase, the community email_guard extension normalizes Gmail addresses in a before-user-created hook and rejects repeats. Either way, pair it with disposable email blocking, or test one address in the disposable email checker.