Using An AWS CloudFormation Stack To Allow "-" Instead Of "+" In Gmail Email Addresses


Launch a CloudFormation template to set up a stack of AWS resources to fill a simple need: Supporting Gmail addresses with “-” instead of “+” separating the user name from the arbitrary tag strings.

The CloudFormation stack launched by the template consists of:

  • ELB (Elastic Load Balancer)
  • Auto Scaling Group
  • EC2 instance(s) running Postfix on Ubuntu set up by a user-data script
  • Security Group allowing ELB to connect to the instances
  • CloudWatch CPU high/low alarms
  • Auto Scaling scale up/down policies.
  • SNS (Simple Notification Service) topic for notification of Auto Scaling events
  • Route53 Record Set

This basic stack structure can be used as a solution for a large number of different needs, but in this example it is set up as an SMTP email relay that filters and translates email addresses for Google Apps for Business customers.

Because it uses Auto Scaling, ELB, and Route53, it is scalable and able to recover from various types of failures.

If you’re in a rush to see code, you can look at the CloudFormation template and the initialization script run from the user-data script.

Now, let’s look a bit more in depth at the problem this is solving and how to set up the solution.


If you have a Gmail address of, then email messages sent to addresses of the form will also be delivered to you. You can use any email address string after the plus sign.

Google describes this feature in a blog post:

Append a plus (“+”) sign and any combination of words or numbers after your email address. For example, if your name was, you could send mail to or

This is is useful for tracking where you have entered your email address and findingout which services allow it to be used for spam. If an email variation starts getting abused, you can automatically filter it out in Gmail.

The Problem

Unfortunately, many web sites do not allow an email address with a “+” when registering and will reject any attempts to use this. I don’t know if they are trying to prevent people from using unique tracking addresses or if they just don’t know the specification for a valid email address, but the end result is the same.

If we could just use a dash (-) instead of a plus, we could enter unique tracking email addresses in each site registration.

Another example for why plus can be bad: My son added “+psat” to his email address when filling out the written PSAT so he could track who they sold his email address to (apparently every college out there). The data entry person typed a “t” instead of a “+”, so colleges started sending emails to the wrong address.


The approach presented here works with custom domains set up with Google Apps for Business. You can’t use it for individual, free “” addresses without some additional work and a separate domain name registration.

As currently written, the CloudFormation stack requires that you already have your domain DNS handled by Route53, as the template will insert a new DNS entry for the email relay. This functionality could be removed from the template if you don’t use Route53.

The Solution

This CloudFormation template sets up a stack that will translate email addresses when Gmail forwards messages for unknown users (with dashes in the address).

After this is set up, email delivered to Gmail for the standard and plus domain email addresses, say and, will still be processed exactly as they were before. This stack does not interfere with that operation.

When email is addressed to the new dash form, like, Gmail will not be able to find the user, and will forward this to the email relay set up by the CloudFormation template.

The email relay will translate the dash in back to a plus as and relay the message back to Gmail for standard delivery to the user.


The Route53 DNS name is set to point at the ELB. The Load Balancer is listening on the SMTP (email) port and forwards connections to the instance(s) in the Auto Scaling group.

The Auto Scaling group make sure that there is at least 1 (or the min you specify) instance running and will replace failed instances. It also monitors the CPU usage on the instances and scales up (and down) more instances as specified.

When an instance is started by the Auto Scaling group, it runs the user-data script which installs and configures Postfix to accept email for users at the configured domain. The Postfix configuration then replaces the dash with a plus and submits the message back to the standard MX servers for the domain (e.g., Gmail).

When a scaling event happens, the SNS topic is notified which triggers an email to the address provided to the template. Other addresses and listeners can be subscribed to and unsubscribed from the SNS topic.

You get to pick the instance type, min, and max when you run the template, so that you can meet your company’s volume and cost needs.

Now, let’s look at how to set it all up.

Step 1: Launch CloudFormation Stack

You can run the CloudFormation template with the AWS console or with the command line. To run it through the AWS Console in the us-east-1 region, simply click this button:

Launch Stack

Fill out the template parameters and launch the stack. Once it’s running, follow the Google Apps Setup below.

If you have installed the AWS command line tools, then you can launch the stack in us-west-2 using commands like:
ssh_key_name=$USER  # Your ssh keypair name here
stackname="example-$host-$(date +%Y%m%d-%H%M)"

cfn-create-stack   --region $region   --stack-name "$stackname"   --template-file email-relay-dash-to-plus.template   --parameters "InstanceType=$instance_type;OperatorEmail=$notification_email;SshKeyName=$ssh_key_name;DnsDomain=$dnsdomain;DnsHostName=$dnshost;MinInstances=$min_instances;MaxInstances=$max_instances"

Once it’s running, follow the Google Apps Setup below.

Step 2: Configure Google Apps

Once the stack is running, configure Google Apps to forward unrecognized email addresses to the email relay:

  • Log in to administer your domain in Google Apps

  • Select “Google Apps”

  • Select “Gmail”

  • Select “Advanced”

  • Scroll down to “Email Routing”

  • Select “Add Another Destination”

  • In the “Destination:” field, add the hostname.domainname of your email relay access (e.g.,

  • Leave this option selected: (X) “Unknown mailbox accounts only”

Note: If Gmail forwards an unknown email address without a dash, the relay will simply reject it as unknown. This should not cause problems unless you need other unknown email address processing.

Step 3: Test

Make sure you can send email to allow of the following forms and have it delivered to the same user:



If you are just testing this out, don’t forget to delete the CloudFormation stack using the AWS console, or on the command line with:

cfn-delete-stack --region $region --force --stack-name "$stackname"


  • Though I am using this setup for a low-volume domain under Google Apps for Business, it may not work for every domain with high volume or other odd configurations. Please review the code and test to make sure it does what you need.

  • This CloudFormation stack tells AutoScaling to initialize each instance with a script that is downloaded from the GitHub repository for this project. You can remove your dependency on that repository (which may change as the software is improved) by copying the script to your own location (e.g., S3) and providing that URL in the CloudFormation template’s InitializationScriptURL parameter.

  • The Auto Scaling policies have not ben tested extensively. You may need to adjust them for scaling under real world load.

I’d be extremely curious to know if anybody actually runs one of these CloudFormation stacks and gets it to work—or where you had trouble. I’d also like to know your level of interest in CloudFormation and how much experience you’ve had with it. Would further CloudFormation articles be useful? At what level (beginner, intermediate, expert)?

Update 2012-07-22: @pmocek on Twitter points out that “-” is called a hyphen or a minus, not a dash.

Leave a comment

Ubuntu AMIs

Ubuntu AMIs for EC2:

More Entries

When Are Your SSL Certificates Expiring on AWS?
If you uploaded SSL certificates to Amazon Web Services for ELB (Elastic Load Balancing) or CloudFront (CDN), then you will want to keep an eye on the expiration dates and…
Throw Away The Password To Your AWS Account
reduce the risk of losing control of your AWS account by not knowing the root account password As Amazon states, one of the best practices for using AWS is Don’t…
AWS Community Heroes Program
Amazon Web Services recently announced an AWS Community Heroes Program where they are starting to recognize publicly some of the many individuals around the world who contribute in so many…
EBS-SSD Boot AMIs For Ubuntu On Amazon EC2
With Amazon’s announcement that SSD is now available for EBS volumes, they have also declared this the recommended EBS volume type. The good folks at Canonical are now building Ubuntu…
EC2 create-image Does Not Fully "Stop" The Instance
The EC2 create-image API/command/console action is a convenient trigger to create an AMI from a running (or stopped) EBS boot instance. It takes a snapshot of the instance’s EBS volume(s)…
Finding the Region for an AWS Resource ID
use concurrent AWS command line requests to search the world for your instance, image, volume, snapshot, … Background Amazon EC2 and many other AWS services are divided up into various…
Changing The Default "ubuntu" Username On New EC2 Instances
configure your own ssh username in user-data The official Ubuntu AMIs create a default user with the username ubuntu which is used for the initial ssh access, i.e.: ssh ubuntu@<HOST>…
Default ssh Usernames For Connecting To EC2 Instances
Each AMI publisher on EC2 decides what user (or users) should have ssh access enabled by default and what ssh credentials should allow you to gain access as that user.…
New c3.* Instance Types on Amazon EC2 - Nice!
Worth switching. Amazon shared that the new c3.* instance types have been in high demand on EC2 since they were released. I finally had a minute to take a look…
Query EC2 Account Limits with AWS API
Here’s a useful tip mentioned in one of the sessions at AWS re:Invent this year. There is a little known API call that lets you query some of the EC2…
Using aws-cli --query Option To Simplify Output
My favorite session at AWS re:Invent was James Saryerwinnie’s clear, concise, and informative tour of the aws-cli (command line interface), which according to GitHub logs he is enhancing like crazy.…
Reset S3 Object Timestamp for Bucket Lifecycle Expiration
use aws-cli to extend expiration and restart the delete or archive countdown on objects in an S3 bucket Background S3 buckets allow you to specify lifecycle rules that tell AWS…
Installing aws-cli, the New AWS Command Line Tool
consistent control over more AWS services with aws-cli, a single, powerful command line tool from Amazon Readers of this tech blog know that I am a fan of the power…
Using An AWS CloudFormation Stack To Allow "-" Instead Of "+" In Gmail Email Addresses
Launch a CloudFormation template to set up a stack of AWS resources to fill a simple need: Supporting Gmail addresses with “-” instead of “+” separating the user name from…
New Options In ec2-expire-snapshots v0.11
The ec2-expire-snapshots program can be used to expire EBS snapshots in Amazon EC2 on a regular schedule that you define. It can be used as a companion to ec2-consistent-snapshot or…
Replacing a CloudFront Distribution to "Invalidate" All Objects
I was chatting with Kevin Boyd (aka Beryllium) on the ##aws Freenode IRC channel about the challenge of invalidating a large number of CloudFront objects (35,000) due to a problem…
Email Alerts for AWS Billing Alarms
using CloudWatch and SNS to send yourself email messages when AWS costs accrue past limits you define The Amazon documentation describes how to use the AWS console to monitor your…
Cost of Transitioning S3 Objects to Glacier
how I was surprised by a large AWS charge and how to calculate the break-even point Glacier Archival of S3 Objects Amazon recently introduced a fantastic new feature where S3…
Running Ubuntu on Amazon EC2 in Sydney, Australia
Amazon has announced a new AWS region in Sydney, Australia with the name ap-southeast-2. The official Ubuntu AMI lookup pages (1, 2) don’t seem to be showing the new location…
Save Money by Giving Away Unused Heavy Utilization Reserved Instances
You may be able to save on future EC2 expenses by selling an unused Reserved Instance for less than its true value or even $0.01, provided it is in the…
Installing AWS Command Line Tools from Amazon Downloads
This article describes how to install the old generation of AWS command line tools. For the most part, these have been replaced with the new AWS cli that is…
Convert Running EC2 Instance to EBS-Optimized Instance with Provisioned IOPS EBS Volumes
Amazon just announced two related features for getting super-fast, consistent performance with EBS volumes: (1) Provisioned IOPS EBS volumes, and (2) EBS-Optimized Instances. Starting new instances and EBS volumes with…
Which EC2 Availability Zone is Affected by an Outage?
Did you know that Amazon includes status messages about the health of availability zones in the output of the ec2-describe-availability-zones command, the associated API call, and the AWS console? Right…
Installing AWS Command Line Tools Using Ubuntu Packages
See also: Installing AWS Command Line Tools from Amazon Downloads Here are the steps for installing the AWS command line tools that are currently available as Ubuntu packages. These include:…
Ubuntu Developer Summit, May 2012 (Oakland)
I will be attending the Ubuntu Developer Summit (UDS) next week in Oakland, CA. ┬áThis event brings people from around the world together in one place every six months to…
Uploading Known ssh Host Key in EC2 user-data Script
The ssh protocol uses two different keys to keep you secure: The user ssh key is the one we normally think of. This authenticates us to the remote host, proving…
Seeding Torrents with Amazon S3 and s3cmd on Ubuntu
Amazon Web Services is such a huge, complex service with so many products and features that sometimes very simple but powerful features fall through the cracks when you’re reading the…
There are a number of CloudCamp events coming up in cities around the world. These are free events, organized around the various concepts, technologies, and services that fall under the…
Use the Same Architecture (64-bit) on All EC2 Instance Types
A few hours ago, Amazon AWS announced that all EC2 instance types can now run 64-bit AMIs. Though t1.micro, m1.small, and c1.medium will continue to also support 32-bit AMIs, it…
ec2-consistent-snapshot on GitHub and v0.43 Released
The source for ec2-conssitent-snapshot has historically been available here: ec2-consistent-snapshot on using Bazaar For your convenience, it is now also available here: ec2-consistent-snapshot on GitHub using Git You are…