Hacker News Reader

Hacker News

Comment by fsckin | Hacker News Reader

Parent Full thread

fsckin

It's a little bit more than a regex. From the documentation[0]:

Given an arbitrary address, we will validate the address based on:

Syntax checks (RFC defined grammar)

DNS validation

Spell checks

Email Service Provider (ESP) specific local-part grammar (if available).

[0] http://documentation.mailgun.com/api-email-validation.html

View on HN

I know, it's a great deal more than a regex, and that's actually my point. It's dedicating tons of extra resources and time to a process that is ultimately redundant.

You can't truly validate someone's email address because you don't know what their email address actually is. Your only two options are:

1. Be omniscient

2. Send a validation email

It stops people from doing something like fake@lolthisisstupid.com at least though.

I wish more places would validate their email. In the past two days I've been informed that I know have a Playstation, EA, and Blizzard account because someone signed up with my email address (just without the dots.)

Only Blizzard tried to confirm the email address. The other two created the account, and now won't let me disown the accounts. I can go through the forgot password process and turn them off, but I'm not sure how kosher that is.

Have you ever crafted a sign-up form for a paid app though? Requiring users go and check their email before they can proceed is going to kill conversions. Mail providers (I use mandrill) also deliberately throttle outgoing email - I've seen them delayed by several minutes.

If someone's buying something from my site, I'm not going to send them a validation email during the checkout process.

Something like this greatly reduces the number customer support emails saying "I didn't get an order confirmation email from you!" when they typed in joe@yahoo.cm.

But no validation in the world will catch that. Only a round-trip email would.

EDIT: I was wrong. Interesting.

... not with 100% accuracy, but it's totally plausible that you can do substantially better than random (or a simple regex). So there is incremental value here.

That's the point: Mailgun's Validation API does catch that joe@yahoo.cm is incorrect and suggests a correction. Try it: http://mailgun.github.io/validator-demo/

I see that as the only valuable part of this service, and I can instead use it statically via mailcheck JavaScript: https://github.com/Kicksend/mailcheck

thanks for the link. this is actually true considering the email validation embedded in HTML5.

> 2. Send a validation email

The big three providers all have OpenID or OAuth endpoints that return email addresses, so you also have the option of asking the domain directly.

(You can outsource that whole thing, too... * coughs something about Mozilla Persona *)

DNS Validation

I wonder if they will also be able to tag domains/addresses as potential spam-bots.

It flagged my favorite fake email that does have valid A record, but no MX record 'example@example.com' as invalid.

The email spec allows for missing MX records, it should fallback to use the A record to deliver instead.

Hopefully they aren't invalidating domains that don't have an MX record.

Hi fsckin, example@example.com fails because while we do fallback to A records, no mail exchanger responds to us, so no one can actually receive mail at that inbox which is why we mark it as invalid.

Just curious: is this a one-time immediate check for an MX that responds?

Say, for example, that example.com has only a single MX and for whatever reason (server is down, network connectivity is broken, etc.) it is unreachable or unresponsive at the exact time you test. Would that constitute a "fatal error" in your validation process?

If there is a single MX RR but it "expands" to multiple hosts (multiple A RRs), do you test a second one if the first doesn't respond?

TIA!

Anything @example.com is actually invalid due to it being reserved by RFC 2606.

Reply on news.ycombinator.com