11–20 of 68 posts
That's the easiest and most accurate way to do it by regex. Sure, some invalid addresses may still get accepted, but that is unavoidable. Even the most thorough validation[0] is going to accept nonexistent addresses.
[0] Except those that validate by sending a mail to it. Sending an email is the only way to be sure.
I once heard the story of a man who helped Aruba set up their DNS (.aw) in the late 90's. In exchange, as part of his compensation, he asked for an email address at the top-level domain, and received something like js@aw, which is a perfectly functional email address, but trips up a lot of validators.
> One more interesting tidbit is if you use unique sub-addresses for each of the sites you sign up to you will be able to see when someone, or rather who, sells your email to someone else... Busted! Can't the spammers simply strip the subaddress/label after '+' ?
They can. They don't. It's extra effort for them for nearly zero marginal gain.
I was neglecting this quote for a long time, until I started using regular expressions in real projects...
https://github.com/mailcheck/mailcheck
I agree with the idea that it's impossible to validate. But, mailcheck takes the approach of seeing if the email is potentially wrong, then prompting the user with what it thinks they meant. It's usually right, but if not, it allows whatever the user wants.
For example, if your user types in "user@gmil.con", it will suggest "user@gmail.com".
If you want to send email to that address, you're probably going to want something that can suggest gmail as a replacement for gmial. You can also check that the domain exists and has a MX record. If you run your own mail server you can probably even check that the mailbox exists...
If you want emails to be unique, you'll need to apply per-site logic like gmails optional .'s and strip the + segments. That's important if you're combining multiple lists of emails, or importing an existing mailing list for a user.
The gist is the real world is complicated, but you can pretty easily set up something that handles 90% of it.
> One more interesting tidbit is if you use unique sub-addresses for each of the sites you sign up to you will be able to see when someone, or rather who, sells your email to someone else... Busted! Can't the spammers simply strip the subaddress/label after '+' ?
Perhaps the reverse is more effective. Use a subaddress for all your mail and ignore that without a label coming in.
If I gave you an email address that you think is invalid, rest assured I did it for a reason. I'm not an imbecile: I know how to type my address correctly (especially when you make me type it twice). For all the imbeciles who don't know how to type their address correctly, the phone system still works fine.
I may have given you my real email address with a plus-sign for a filter. Don't tell me it's invalid.
I may have given you a fake email address, because I know you're just going to spam me. If you tell me it's invalid, I'll either spend an extra few minutes cooking up a better fake email address, or I'll leave your site.
> One more interesting tidbit is if you use unique sub-addresses for each of the sites you sign up to you will be able to see when someone, or rather who, sells your email to someone else... Busted! Can't the spammers simply strip the subaddress/label after '+' ?
They can. They don't. It's extra effort for them for nearly zero marginal gain.
I wouldn't say it's nearly-zero gain; by applying a tiny sed expression they obtain a basically unblockable e-mail address.
It's easy to blacklist johndoe+amazon@gmail.com but very few people would be willing / able to blacklist their top-level johndoe@gmail.com. So the spam keeps coming.
Spammers are annoying but the progammers behind them are smart.