Hacker News Reader

Comment by pikzen | Hacker News Reader

Alternatively, don't validate email addresses with a regex because it's pointless. Check that at least an '@' symbol is present and just send a damn email already[0]. Or better, don't send a damn email at all and let them access it because it's pointless to have an extra verification step.

If you really want to do some clientside validation, just keep a basic regex and warn the user if the address doesn't seem right.. Or use MailCheck[1].

0. http://davidcel.is/blog/2012/09/06/stop-validating-email-add...

1. https://github.com/mailcheck/mailcheck

View on HN

> Or better, don't send a damn email at all and let them access it because it's pointless to have an extra verification step

I've heard lots of people say not to bother validating but I always thought it was because you could just confirm with a verification email. Why's this step useless?

I don't get it either. Not doing any verification ist just an invitation for trouble. "My password doesn't work, why can't you send me a new one?"

Pointless? Methinks you've never worked with Mandrill or another service that penalizes you for hard/soft bounces.

If you validate emails as complying to the email format used by those services, you can reduce your hard bounces to a bare minimum. If you check for a valid mail server at that domain, you can reduce that to 0. If you connect to their server and check for an error for that mailbox, you can reduce your soft bounces to 0 too, but that requires a lot of legwork to set up.

If you're willing to work with a service that you're paying for AND that penalizes you for erroneous bounces, that's kind of your problem.

It even sounds like you're doing their work.

> Check that at least an '@' symbol is present and just send a damn email already[0].

Checking there's a dot after the @ is probably a good idea. Although it theoretically blocks people who want mail sent to a TLD, that probably isn't a big effective issue.

Or, if you want to do something inbetween the two, and be reasonably certain it's a real email but not having to have the customer validate, do a quick MX lookup on the domain they supply (cache these on a local bind instance or whatever if you like), and if you really want to go a step further, send a quick HELO and headerset to the remote SMTP server (many libraries will do this for you), and see if responds with a 250.

Of course, all this takes time, so you always have a tradeoff between speed and validation level, from full-on user-validated email to "enter whatever".

Regexps are not only about validation. E.g. sometimes you want to scan some text for e-mails (to highlight them, protect, scrap or whatever).

Although for most languages if there's nothing built in, there's at least one lib that provides it. I prefer using that over copy-pasting it from some random website.

Reply on news.ycombinator.com