• Type: CUSTOMER
• Severity:  WARNING
• Protection against: HACKING
• CIS: -
• FIX Available: YES

This Customer Check verifies if the plus sign (+) can be used in recipients' email addresses.

Why this check?

By using a + sign, an employee can create an unlimited number of aliases for their own mailbox. When the normal email address is: "name@domain.nl", with plus addressing enabled, emails directed to "name+anytext@domain.nl" will also end up in the same mailbox. 

This allows employees to use a separate email address for each (online) service they register for. If a data breach ever occurs at one of those services, it will be immediately clear which service it was. 

For more explanation on Plus Addressing, see: https://docs.microsoft.com/en-us/exchange/recipients-in-exchange-online/plus-addressing-in-exchange-online 

Note: if you are using a Hybrid Microsoft installation (where the Email and/or AD functions are synchronized from the cloud to servers in your own network), this check cannot function. 

What are the possible outcomes of the check?

This check has two possible outcomes. In Attic, this is reflected as follows:

• Okay: Plus Addressing is enabled or you have a Hybrid Microsoft installation
• Warning: Plus Addressing is not yet enabled.

How should this be followed up?

If the output is Warning , we advise enabling Plus Addressing.

A Fix is available for this check, which we will offer via Attic.