Live data from Hacker News

The Correct Way to Validate Email Addresses

hackernoon.com

21–30 of 405 posts

Re: The Correct Way to Validate Email Addresses

#21

I do a lot of optin email. Here are some examples of bounced emails that people use to sign up: * somename@gmail.co * anothername@yhoo.com * myemail@hotmial.com These are very common errors that occur nearly every day. A regex isn't going to help here. What does help, is a notification that asks people to verify what they typed –– if the email contains an obvious, common error, such as one listed above.

Asking to retype though being a simple solution IMHO is asking for a lot. Consider a user who uses mobile phone, even copy paste is annoying. Validating if the mail box exists and that it does not belong to a provider like mailinator and then sending a confirmation link to them works. While its not perfect, it does address lot of other concerns without sacrificing user experience.

Re: The Correct Way to Validate Email Addresses

#22

This is the best comprehensive way that I've found: https://github.com/kdisneur/email_checker It breaks down into 3 parts that can be used either independently or as a whole: format, MX and SMTP.

That one fails " "@example.com and test@example, both of which are legal.

Also, since it relies on looking up MX records and then making an SMTP connection to check if the user exists, why not just send the confirmation email? You've already done all of the expensive stuff at that point.

Re: The Correct Way to Validate Email Addresses

#23
All of that statistical analysis was actually a bit silly, because I've never heard the "typo" argument as a reason for email grammar validation[1]. Sounds like a straw man. It didn't need to be disproven.

The conclusion is sound (although leaves out a discussion of the whether an email confirmation field is at least better than nothing).

[1]: (As a side note, I think the most common explanations for grammar validation are programmer perfectionism and proactively stopping user garbage, such as copy-paste errors or intentionally fluffed fields that will result in a bounced email anyway.)

Re: The Correct Way to Validate Email Addresses

#24
post #13

I always assumed it was more a sanitization issue for security's sake. By allowing only a simple subset ("common") email address type, you can be ambivalent about what email server is running and how it reacts to the wide variety of specially crafted email addresses. With no validation other than sending the email, you have to know, for example, what the server would do with an email address that claims to be @localh…

And that's a great philosophy until your email gets rejected by some service that picked a different "common class of email addresses" than you did. This is precisely why we have written standards.

Re: The Correct Way to Validate Email Addresses

#25

Hmm, sorry but I don't buy that the "correct way to validate" is not to validate the input. Email addresses aren't a special enough case to be handled differently than any other user input, which we always validate to both sanitize and show client-side errors, if nothing else. Sure, the complete regex is complex, but it is defined and is hardly unconquerable. Look at Django's `EmailValidator` implementation for examp…

You can use a regex as a simple pre-check but you absolutely have to do more than that if you expect high-quality results.

Back in the 90s, we ran the customer rewards program mailing list for a mainstream business you've heard of. A [gnarly] regex took care of the gross failures but we still had double-digit percentage of invalid addresses and many spam reports because people mistyped their username, used their old ISP's email address which had been disconnected, etc.

The only approach which produced satisfactory results back then was to have a bit of (horrible) PHP code which did a full SMTP connection to deliver the welcome email. Even that wasn't enough to ensure you'd delivered it to the right person, however, so we had to track clicks on an activation link.

I would be surprised if the average internet user has gotten significantly more reliable over the last couple of decades and that's born out by the wide variety of misdirected legitimate email my shortname@gmail.com account receives.

Re: The Correct Way to Validate Email Addresses

#26
post #2

TL;DR the odds that the user entered an incorrect-but-valid address are way higher than that they entered one which will not actually be able to receive mail. Send a validation email.

Address validation by sending an email should only be used if it is required for some reason to verify the user owns the email account. Otherwise, it's not a great UX.

Re: The Correct Way to Validate Email Addresses

#27
One thing I've found that helps a lot is instant delivery notifications. When you try to register a new account, our "We've sent a confirmation email" screen will report within a few seconds if there was a mail delivery error and allow the user to correct their address. Common typo detection for popular email domains is also beneficial (https://github.com/mailcheck/mailcheck)

Re: The Correct Way to Validate Email Addresses

#28
If someone's valid email address

[*\"32f2@13.31.43.11

they are up to no good and I don't want them as my customer.

Also, according to the standard email addresses supposed to be case sensitive, since the username part refers to a unix user and unix is case sensitive. I work with a lot of email address lists originally collected on paper and of course noone knows that. So as bad as it sounds, part of my sanitation process is to lowercase everything. Noone ever complained. What the standard says and what people actually do is very different.

Re: The Correct Way to Validate Email Addresses

#29
Great article. Wrong. Question.

The better question: In it's current form, is an email addresses really the best way to do what it is that's trying to be accomplished? (Hint: It's a fax machine.)

I mean, if I have have a phone number, why can't I have an email number? Okay, perhaps not the greatest example. But then again, if a phone number can be switched from one carrier to another, in the second decade of the 21st century shouldn't "email" get the same consideration?

Instead we're talking about regex or some other wonky validation? In 2016? That's just silly.

Re: The Correct Way to Validate Email Addresses

#30
The number of websites that try reject my email address with a + in it, ugh!

Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)

Post reply on HN