Reply to thread

It is trivial to bypass XenForo email bans using sub-addressing (also known as "plus addressing") or, for some email providers such as Gmail, by inserting . dots between the local-part characters of the address.

To reproduce:

1. Ban example@gmail.com.
2. Attempt to register a new account with example+alias@gmail.com. The request should be blocked but it will be successful and the registration confirmation email will be delivered to example@gmail.com.
3. Attempt to register a new account with ex.ample@gmail.com. The request should be blocked but it will again be successful with the registration confirmation email delivered to example@gmail.com.

This allows spammers and abusive users to quickly create multiple accounts with a theoretically unlimited number of unique email addresses.

Although the +  or . characters could simply be banned, they are widely used for legitimate reasons.

From Wikipedia:

Bypassing XenForo's email ban could be prevented by stripping . characters and dropping any +aliases from the local-part of email addresses before comparing them against the forum's banned email list. This would allow legitimate users to continue using dots and plus-addressing aliases in their email addresses while preventing malicious users from abusing these email features.