# Plus-Alias Detection

Some temp-mail services distribute plus-aliases on Gmail, Outlook, Hotmail, Live, MSN, and iCloud mailboxes. A domain check alone cannot distinguish those addresses from other users at the same provider.

## Canonicalization

For supported providers, DISIFY compares a canonical form of the address with known temp-mail base accounts:

- Lowercase the local-part and domain.
- Strip everything from `+` to `@` (the plus-alias tag).
- Map `googlemail.com` → `gmail.com`.
- For `gmail.com` only: remove dots from the local-part.
- Preserve dots for Microsoft and Apple domains.

An exact match sets `disposable: true`. Send the original address to the API; this normalization happens inside DISIFY, and the original alias pattern is also used for heuristics.

## Flagged response

```json
{
  "format": true,
  "alias": true,
  "domain": "gmail.com",
  "disposable": true,
  "dns": true,
  "whitelist": true,
  "confidence": 100,
  "signals": ["alias_base_exact"],
  "domain_info": { "tld": "com", "is_subdomain": false, "parent_domain": null },
  "mx_info": [
    "gmail-smtp-in.l.google.com",
    "alt1.gmail-smtp-in.l.google.com",
    "alt2.gmail-smtp-in.l.google.com",
    "alt3.gmail-smtp-in.l.google.com",
    "alt4.gmail-smtp-in.l.google.com"
  ],
  "role": false,
  "free": true
}
```

`alias` is `true` here because the address carries a `+tag`; it flags the presence of an alias tag, not the verdict itself.

**whitelist + disposable together**

An exact base-account match can return `"whitelist": true` alongside `"disposable": true`. The whitelist describes the provider; the disposable result applies to the specific address. **Use `disposable` as the disposable verdict.**

## Heuristic patterns

The `free_provider_alias_pattern` signal reports suspicious patterns without an exact base-account match:

- **Gmail** — a base local-part with 4+ dots or 2+ numeric dot segments.
- **Any supported provider** — a short alphanumeric `+tag` containing both letters and digits.

It adds 35 confidence points without changing `disposable` itself. A suspicious pattern is not proof of a temp-mail account. See [Confidence Scoring](https://docs.disify.com/api/confidence.md).

## Why it matters for caching

`user@gmail.com` and `user+temp@gmail.com` can have different verdicts. A cached domain-level verdict must not replace either individual check. If you cache individual results, keep the complete input and requested features separate, and use an explicit freshness policy. See [Best Practices](https://docs.disify.com/resources/best-practices.md).

Source: https://docs.disify.com/api/plus-alias.html