Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.

While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address.

However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person.

In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address).

Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.

To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.

Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them.

This on service providers to implement secure access properly.

I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.

Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution.

You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.

I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.

> You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.

Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak.

> I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.

And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness?

You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.

> Why can't it be both sides' issue?

Even if Google didn't provide this feature to their users (and it is a feature that I regularly use to track who leaks my email address and then auto block emails to that address), Netflix's approach of sending sensitive emails without verifying the email address is still prone to security problems. Many people have multiple email accounts, or aren't really aware which email account they used to sign up. Sending a "please update your billing info" without verifying the email account first is purely on Netflix.