# Enabling e-mail normalization by default
**URL:** https://meta.discourse.org/t/enabling-e-mail-normalization-by-default/338641
**Category:** Announcements
**Created:** [November 28, 2024, 2:22am UTC](https://meta.discourse.org/t/enabling-e-mail-normalization-by-default/338641 "2024-11-28T02:22:40Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ted](https://meta.discourse.org/u/ted)
#### Post date: [November 28, 2024, 2:22am UTC](https://meta.discourse.org/t/enabling-e-mail-normalization-by-default/338641/1 "2024-11-28T02:22:40Z")
### Background
In the past, Discourse has shipped with e-mail normalization off. As a result of this, users can create multiple accounts using the same canonical e-mail, through the use of [plus addressing](https://www.codetwo.com/admins-blog/plus-addressing/). For example, a user with an account tied to `bob@discourse.org` is able to create another account tied to `bob+again@discourse.org`.
Discourse comes with the `normalize_emails` site setting which can be flipped to either allow or disallow this. When turned on, it considers both e-mails above to be the same for purposes of unique account validation, and Bob won’t be able to create the second account.
### Why are we changing it?
We have seen a big increase in spam sign-ups lately, with some sites receiving hundreds or even thousands of sign-ups from a single e-mail through the use of plus addressing. Needless to say, this is a rather nasty surprise when it does happen.
On the flip side, the reasons for allowing plus address sign-ups are mostly for facilitating staff testing, i.e. setting up test users without having to register new e-mails.
After considering this, we think it’s a much healthier default to have e-mail normalization enabled, and let admins disable it if and when it’s needed.
### What about SSO?
Since users have less control over the exact e-mail being used when using single sign-on using `discourse-connect`, this setting is ignored when using it.
### But I liked/wanted this turned off
If you actively changed this setting in the past, we won’t do anything to it. It will remain set to whatever you configured.
Even if you didn’t, don’t fret. The setting is still there. Just head over to `/admin/site_settings` and turn it right back off. :slightly_smiling_face:
---
### Author:  [@traceymoko](https://meta.discourse.org/u/traceymoko)
#### Post date: [November 28, 2024, 5:27am UTC](https://meta.discourse.org/t/enabling-e-mail-normalization-by-default/338641/2 "2024-11-28T05:27:58Z")
> [@ted](#):
>
> For example, a user with an account tied to `bob@discourse.org` is able to create another account tied to `bob+again@discourse.org`.
>
> Discourse comes with the `normalize_emails` site setting which can be flipped to either allow or disallow this. When turned on, it considers both e-mails above to be the same for purposes of unique account validation, and Bob won’t be able to create the second account.
>
> ### Why are we changing it?
>
> We have seen a big increase in spam sign-ups lately, with some sites receiving hundreds or even thousands of sign-ups from a single e-mail through the use of plus addressing. Needless to say, this is a rather nasty surprise when it does happen.
This is great to hear. (I recall waaaay back when this was a huge problem for markersocial who had to really push hard for any changes to be made to core.)
> [@Protecting against gmail dot trick in Discourse](https://meta.discourse.org/t/protecting-against-gmail-dot-trick-in-discourse/22627/56):
>
> Great thanks @sam and sorry I didn’t follow up on this yet. Yes it still seems quite viable to make a lot of accounts using this trick (2.5.0.beta1). For example, using the username+{randomstring}@gmail.com trick, someone created 748 accounts in the last 10hrs. They already have thousands of accounts on this single gmail address. Pretty much the only way for me to be able to remove them from the admin area is manually going to each account individually to suspend and/or delete them. It’s not …
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [November 28, 2024, 6:51am UTC](https://meta.discourse.org/t/enabling-e-mail-normalization-by-default/338641/3 "2024-11-28T06:51:09Z")
Would category addresses stil work? That system depends totally of plus-addresses.
---
### Author:  [@ToddZ](https://meta.discourse.org/u/ToddZ)
#### Post date: [September 27, 2025, 4:40am UTC](https://meta.discourse.org/t/enabling-e-mail-normalization-by-default/338641/4 "2025-09-27T04:40:10Z")
Looks like this is only about email addresses used for account creation. I imagine there would have been some noise if it had any effect on category inbound addresses.