The only way to correctly validate an email address is to send a message to it, and verify that it arrived.
If you’re accepting email addresses as user input (e.g. from a web form), it might be nice to check that what’s to the right of the rightmost @ sign is a domain name with an MX or A record. That way, if a user enters a typo’d address, you have some chance of telling them that instead of handing an email to user#example.net or user@gmailc.om to your MTA.
But the validity of the local-part (left of the rightmost @) is up to the receiving server.
Checking MX in your application means you needlessly fail on transient outages, like when a DNS server is rebooting or a net link hiccups. When it happens, this is likely to confuse or frustrate the user, will definitely waste their time, and may drive them away and/or generate support calls.
Also, MX records are not always needed for mail to be delivered.
Better to just hand the verification message off to your mail server, which knows how to handle these things. You can flag the address if your outgoing mail server refuses to accept it.
If DNS is transiently down, the most common mail domains are still in local resolver cache. And if you’re parsing live user requests, that means the IP network itself is not in transient failure at the moment. So it takes a pretty narrow kind of failure to trigger a problem… And the outcome is the app tells the user to recheck their email address, they do, and they retry and it works.
If DNS is having a worse problem, it’s probably down for your mail server too, which means an email would at least sit in the outbound mail spool for a bit until DNS comes back. Meanwhile the user is wondering where their confirmation email is, because people expect email delivery in seconds these days.
So yeah … yay, tradeoffs!
(Confirmation emails are still important for closed-loop opt-in, to make sure the user isn’t signing someone else up for your marketing department’s spam, though.)
Which ones? In RFC 5322 every address contains an addr-spec at some point, which in turn must include an @. RFC 6854 does not seem to change this. Or did I misread something?
Remember, we’re taking about regular expressions here so .+ means “a sequence of one or more arbitrary characters”. It does not imply that an actual dot is present.
fuck any website that requires an account to just READ it’s stupid content and at the same time blocks guerrillamail/10minutemail (looking at you, Glassdoor,I don’t want to get fucking spam just so that I can check approximate salary in a company)
Sounds like your gripe is with people requiring accounts for reading public content, and not with preventing usage of automated email creation and trying to limit bots on your website.
Imagine giving someone your phone number, and having them say you have to get a different one because they don’t like some of the digits in it.
I have seen this nonsense more times than I care to remember. Please don’t build systems that way.
If you’re trying to do bot detection of the like, use a different approach. Blacklisting email addresses based on domain or any other pattern does a poor job of it and creates an awful user experience.
Amen.
Spoiler alert: Few of them are good, and those few are so simple that you might as well not use a library.
The only way to correctly validate an email address is to send a message to it, and verify that it arrived.
If you’re accepting email addresses as user input (e.g. from a web form), it might be nice to check that what’s to the right of the rightmost
@
sign is a domain name with an MX or A record. That way, if a user enters a typo’d address, you have some chance of telling them that instead of handing an email touser#example.net
oruser@gmailc.om
to your MTA.But the validity of the local-part (left of the rightmost
@
) is up to the receiving server.Checking MX in your application means you needlessly fail on transient outages, like when a DNS server is rebooting or a net link hiccups. When it happens, this is likely to confuse or frustrate the user, will definitely waste their time, and may drive them away and/or generate support calls.
Also, MX records are not always needed for mail to be delivered.
Better to just hand the verification message off to your mail server, which knows how to handle these things. You can flag the address if your outgoing mail server refuses to accept it.
If DNS is transiently down, the most common mail domains are still in local resolver cache. And if you’re parsing live user requests, that means the IP network itself is not in transient failure at the moment. So it takes a pretty narrow kind of failure to trigger a problem… And the outcome is the app tells the user to recheck their email address, they do, and they retry and it works.
If DNS is having a worse problem, it’s probably down for your mail server too, which means an email would at least sit in the outbound mail spool for a bit until DNS comes back. Meanwhile the user is wondering where their confirmation email is, because people expect email delivery in seconds these days.
So yeah … yay, tradeoffs!
(Confirmation emails are still important for closed-loop opt-in, to make sure the user isn’t signing someone else up for your marketing department’s spam, though.)
You can use a regex to do basic validation. That regex is
.+@.+
. Anything beyond that is a waste of time.That rejects valid emails
Which ones? In RFC 5322 every address contains an addr-spec at some point, which in turn must include an @. RFC 6854 does not seem to change this. Or did I misread something?
EDIT: I’M DUMB I THOUGHT YOU MEANT A LITERAL “.” , that regex is indeed correct.
Original:
This is a valid address:
user.name@[IPv6:2001:db8:1ff::a0b:dbd0]
Relevant spec: https://www.rfc-editor.org/rfc/rfc5321#section-4.1.3
And you all doubted me… :P
Edit: Wait, I also don’t think local-part even needs a “.” in it? user@domain.com should be valid as well.
And it’s matched by
.+@.+
as it contains an @.Remember, we’re taking about regular expressions here so
.+
means “a sequence of one or more arbitrary characters”. It does not imply that an actual dot is present.(And I overlooked the edit. Oops.)
There are also cases where you want to have a disallow list of known bad email providers. That’s also part of the parsing and validating.
fuck any website that requires an account to just READ it’s stupid content and at the same time blocks guerrillamail/10minutemail (looking at you, Glassdoor,I don’t want to get fucking spam just so that I can check approximate salary in a company)
Sounds like your gripe is with people requiring accounts for reading public content, and not with preventing usage of automated email creation and trying to limit bots on your website.
It’s a valid need, but a domain blacklist isn’t part of email parsing and if you conflate the two inside your program then you’re mixing concerns.
Why is the domain blacklist even in your program? It should be a user configurable file or a list of domains in the database.
Imagine giving someone your phone number, and having them say you have to get a different one because they don’t like some of the digits in it.
I have seen this nonsense more times than I care to remember. Please don’t build systems that way.
If you’re trying to do bot detection of the like, use a different approach. Blacklisting email addresses based on domain or any other pattern does a poor job of it and creates an awful user experience.