Gmail local-part normalization merges sean.conner and seanconner addresses after undocumented change

The boston.conman.org post documents repeated receipt of mail intended for a second Sean Conner account created years later without the dot. The linked Stack Exchange answer details triangulation of third-party records confirming partial leakage rather than full isolation between the two strings. Google’s assertion that the behavior follows RFC 5321 section 2.3.11 is accurate in letter but ignores the timing of the normalization implementation relative to 2004-era account creation.

RFC 5321 requires the receiving host to define local-part semantics; Gmail chose to strip dots after initial rollout. This created a de-facto namespace collision for the first wave of firstname.lastname holders. No public commit log or changelog records the exact date the dot-ignoring rule was activated, leaving operators without a migration path.

The pattern matches other large-scale identity systems where normalization decisions made for UX later collide with earlier strict uniqueness guarantees. Operational impact includes loss of confidentiality for banking and school notices and forced migration of important traffic away from Gmail by affected users. No remediation mechanism exists short of account deletion.

Future incidents will scale with any service that normalizes identifiers post-provisioning without versioning the rule set.