Live data from Hacker News

Ask HN: What is the norm for email validation?

news.ycombinator.com

1–10 of 18 posts

Ask HN: What is the norm for email validation?

#1
For email validation, what is the norm for mobile apps? Are people making a service call to third-party like Mailgun, or checking on the client side?

I'm trying to come up with the options on the service side and client side, and what options exist in the Rails environment already. I feel like our CTO is more inclined to go with what other tech companies are using on the mobile apps.

Re: Ask HN: What is the norm for email validation?

#3
post #2

What about passwordless, email-based login? It's easier than username/password login, it verifies the email address, and it provides the same level of security (assuming password can be reset via emailed link).

Cool concept, but would require a complete revamp of our sessions infrastructure....I am looking to slap something on to our codebase to check email formatting after the '@' symbol.

Re: Ask HN: What is the norm for email validation?

#6
post #2

What about passwordless, email-based login? It's easier than username/password login, it verifies the email address, and it provides the same level of security (assuming password can be reset via emailed link).

Greylisting[0] would still be a problem. Signup is exactly the situation where this would be both most likely and most inconvenient.

[0] https://en.wikipedia.org/wiki/Greylisting

Re: Ask HN: What is the norm for email validation?

#7
post #2

What about passwordless, email-based login? It's easier than username/password login, it verifies the email address, and it provides the same level of security (assuming password can be reset via emailed link).

Cool concept, but would require a complete revamp of our sessions infrastructure....I am looking to slap something on to our codebase to check email formatting after the '@' symbol.

The Firefox browser source code has a list of current TLDs, IIRC. There's over a thousand. You could use that to at least verify the TLD part.

The following may not work for your use case and I'm no expert in the area, but it could be possible to write a simple shell script to dig the mx records, and fail out if there's no such, and if you wanted to go a step further, you could open SMTP, and fail out if you can't, and if you wanted to go a step further you could even on the mx maybe even do a direct ping or some other lookup of the address part in that session, so long as the server is not a catchall. I feel the total bandwidth outlay would be no more then a small http roundtrip. Tho you might get a bit of hit on the connection time, or retries, as my feeling is not all SMTP hosts are speedy. Thanks

Post reply on HN