Live data from Hacker News

The Correct Way to Validate Email Addresses

hackernoon.com

131–140 of 405 posts

Re: The Correct Way to Validate Email Addresses

#131
post #120

At this point, our email validity criteria: .+@.+\..{2,} That is, at least one character for the inbox, at least one character for the domain, at least two for the TLD (we assume that TLD-less domains are undeliverable by us). This ensures we don't allow 'a@a' or 'a@a.a', but do allow 'a@a.io'.

a@[IPv6:2001::1] is, unfortunately for your validation regex, a valid e-mail address.

[EDIT: I see that you consider TLD-free e-mail addresses undeliverable; still!]

Re: The Correct Way to Validate Email Addresses

#132
post #120

At this point, our email validity criteria: .+@.+\..{2,} That is, at least one character for the inbox, at least one character for the domain, at least two for the TLD (we assume that TLD-less domains are undeliverable by us). This ensures we don't allow 'a@a' or 'a@a.a', but do allow 'a@a.io'.

This might already filter out legitimate users.

  dig MX io.
Also, you don't know what new TLDs ICANN might come up with at some point. I am pretty sure there are service providers that do and did limit the TLD length and then TLDs like xn--vermgensberatung-pwb came up.

Re: The Correct Way to Validate Email Addresses

#133
post #97

Earlier quoted context omitted.

These days I do this differently; I created a subdomain that forwards all email to my main account. hackernews@foo.example.com would forward to main@example.com, and I can just filter the prefixes. That way I can use the subdomain for my own unique addresses, without interfering or using up addresses on the parent domain.

This is probably a better approach if your domain provider supports wildcard DNS records. My old provider did not and I am very glad I switched.

I don't need wildcard DNS, I have a catchall on a single subdomain.

Re: The Correct Way to Validate Email Addresses

#134

Earlier quoted context omitted.

Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...

scarier still is when they let you set it but fail to let you log in (generally happens more with length). i don't know what you're doing, but i know it's not right and it scares the hell out of me

I had that happen because of length at an online service we needed to use in high school. I believe my password had 9 characters. After requesting a password reset and experimenting I found that the registration form would allow you to enter a password of any length, but the login form would only accept up to 8 characters. What really shocked me was that I was the only one of my classmates that used a password longer than 8 characters.

Re: The Correct Way to Validate Email Addresses

#135
No. Absolutely beginner level blog post. You would use a third party tool like http://www.datavalidation.com/ or mailgun's email validation service or BriteVerify etc etc. There are a ton of validation services now. We are living in a time when trillions of email addresses have been tried, entered and deployed to. So why reinvent the wheel on your website? 3rd party services are based not only on parsing the string but also on literally billions of emails actually deployed through various ESP's to tell you up front whether the email address entered by a user is correct. I could use a trashmail email address and it would validate by the OP's standards. First validate using a third party service and then send the double opt-in email to get a user click.

Re: The Correct Way to Validate Email Addresses

#136

No. Absolutely beginner level blog post. You would use a third party tool like http://www.datavalidation.com/ or mailgun's email validation service or BriteVerify etc etc. There are a ton of validation services now. We are living in a time when trillions of email addresses have been tried, entered and deployed to. So why reinvent the wheel on your website? 3rd party services are based not only on parsing the string b…

Passing on user-submitted emails to a third-party service without their explicit consent is a huge privacy leak.

Re: The Correct Way to Validate Email Addresses

#137
post #2

TL;DR the odds that the user entered an incorrect-but-valid address are way higher than that they entered one which will not actually be able to receive mail. Send a validation email.

For flip's sake, yes please! Close the loop, fer crying out loud.

I got a popular givenname.familyname@gmail.com address and I frequently get mail that's meant for other people who share my name. The vast majority of the time it's the individual themselves who sign up for a service or offering but there's rarely a validation upfront.

The best emails are the ones who extend full trust to the email recipient over some account during that first email. Facebook, shame on you.

Re: The Correct Way to Validate Email Addresses

#138

No. Absolutely beginner level blog post. You would use a third party tool like http://www.datavalidation.com/ or mailgun's email validation service or BriteVerify etc etc. There are a ton of validation services now. We are living in a time when trillions of email addresses have been tried, entered and deployed to. So why reinvent the wheel on your website? 3rd party services are based not only on parsing the string b…

/s? I seriously can't tell.

Re: The Correct Way to Validate Email Addresses

#139

Even from http://emailregex.com , a popular regular expression summary for email, states it can only catch 99.99% of validate emails. However, I still like to include some basic form of email validation both on the client and server side, plus the activation email.

>However, I still like to include some basic form of email validation both on the client and server side

I worry you're more likely to permanently block a set of users with valid email addresses than prevent a user from making a typo.

Re: The Correct Way to Validate Email Addresses

#140

Earlier quoted context omitted.

> combined characters like ´e (can't type the correct e with accent mark) You mean é ? :-)

Yes. OS X keyboard drives me nuts sometimes, Karabiner can only fix some bits of the weirdness.

option-e and then a vowel will create {á é í ó ú}

option-u and then a vowel will create {ä ë ï ö ü ÿ}

option-n and then an 'n' will create ñ

Found this out while learning Spanish since holding down keys to select their alternate was way too slow.

Post reply on HN