Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses With Your Complex Regex

davidcel.is

Post reply on HN
Print view View original

111–120 of 211 posts

Re: Stop Validating Email Addresses With Your Complex Regex

#111

Post by ianburrell »

MichaelApproved wrote: post #19
MattBearman wrote: post #12

My goto for email validation is /^.+?@.+?\..+?$/ Incase I've typed it wrong, that should basically work for anything that contains at least one @ and one dot, in that order, as well as at least one character at beginning, middle and end. It's served me well thusfar. Edit for clarification: The reason I prefer this over just checking for an @ is that if you're just checking for @ a common mistake like "me@hotmail,com"…

I thought new TLD being worked on didn't need to have dots in them. Why not just check for x@x?

To use just the TLD, the domain will need to be fully qualified with a trailing dot, "x@tld.". Otherwise, the domain can get confused with just the hostname in the local domain (tld.example.com). Just the hostname is a valid email address but wouldn't need to be accepted by most signup forms.

My guess is that nobody will use just the TLD because of the confusion. And because a lot of software does not support fully qualified names.

Re: Stop Validating Email Addresses With Your Complex Regex

#112

Post by joshfraser »

You'll hurt your email reputation if you send too many emails that bounce. It's worth checking everything you can before firing off an email. This includes using a decent regex and doing a lookup on the domain to make sure they have an MX record. While technically you can have a mail server with no MX record (it falls back to sending to the A record), you won't find too many mail servers configured that way in the wild. In many cases such as email marketing, protecting your email reputation is far more important than handling the 1 in a million user with an unusual email address or mail server configuration.

Re: Stop Validating Email Addresses With Your Complex Regex

#113

Post by ljd »

nostromo wrote: post #90

I don't think this is good advice. From a previous startup we saw a ton of signups like, "john@gmail" and the like. Obviously this person will not get a validation email -- and in all likelihood will not be able to log in to his account when he returns. It's best to catch him when he's entering the information.

I hear and understand a lot of the comments on this thread mention that regex saves the user from a typo and such. So I want to vouch for a github project called mailcheck[0] by the Kicksend team that's great.

At Ventata, we used to have the same issues you've all described with people forgetting things like ".com" and "gmial" vs "gmail". Once we started using mailcheck our bounce rate went way down. Now we only get bounces when people deliberately give us faulty addresses, but we aren't really concerned with trying to convert them. They are checking us out and want to stay anonymous, I don't mind that.

That condition aside, Mailcheck is pretty much all you'll ever need.

[0] https://github.com/kicksend/mailcheck

Re: Stop Validating Email Addresses With Your Complex Regex

#114

Post by oakwhiz »

I don't understand why sites don't just warn the user with a confirmation dialog if their regex doesn't match (e.g. "Your email address looks wrong, are you sure") and allow users to use their potentially invalid email anyway. This avoids the problem of users making obvious mistakes and the problem of users with strange RFC-compliant email addresses being denied.

Re: Stop Validating Email Addresses With Your Complex Regex

#115

Post by anonyfuss »

epochwolf wrote: post #81
anonyfuss wrote: post #56

Earlier quoted context omitted.

> What is so special about parsing email addresses that makes everyone invent their own solution - regex or otherwise? A valid email address can contain almost anything; this makes validation via a standard parser mostly useless. As such, devlopers reach for stricter parsers out of a combination of a not comprehending the standards, feeling vague discomfort about letting 'just anything' past data validation, and misp…

> misplaced concern for users that they believe can't type their own e-mail address How is this misplaced? People screw up even the most basic of computer tasks all the time.

1) Because the solutions actually prevent some users from typing their actual e-mail address.

2) There are so many ways to get the e-mail address wrong that it's almost not worth bothering validating the few things that you can validate.

Now, here's what would be an interesting validation method that doesn't actually require sending an e-mail. It requires an RFC-compliant e-mail parser, not a regexp:

- Perform A/MX lookups on the domain part. The domain part can be an IP address, so those get a free pass.

- Connect to the returned MX, issue a MAIL FROM+RCPT TO:

  c> MAIL FROM: test@example.org
  s> 250 2.1.0 Ok
  c> RCPT TO: is_address_valid@example.com
  s> 554 5.7.1 : Relay access denied
  c> RSET [reset the transaction, no e-mail is sent]
- If you get back a permanent 5xx error, the address is invalid. If you get back a 250 Ok, the address is probably valid (it could still be a relay that allows backscatter, in which case it will allow any address on one of its configured domains). If you receive a 4xx, the address may or may not be valid -- graylisters will send 4xx, as will servers that can't currently accept e-mail, etc.

This gives you definitive failure (5xx) and almost-definitive success (250 Ok). It's a cheap DNS lookup + TCP connection that you can begin performing immediately and asynchronously when a user enters their address in a form.

... or just send the user an activation e-mail.

Re: Stop Validating Email Addresses With Your Complex Regex

#116

Post by jfb »

jerf wrote: post #101
jfb wrote: post #94

Earlier quoted context omitted.

It's featureful because it's old . Who routes email to UUCP any more? Just look at the sections of 5322 that are devoted to "Obsolete Syntax".

Actually, I was just thinking the core error was something else; conflating routing with identity. bob@subgenius.com is a routing instruction, 'J. R. "Bob" Dobbs' is a human identity, and '"J. R. 'Bob' Dobbs" ' is just a mess.

This is a really good point.

Re: Stop Validating Email Addresses With Your Complex Regex

#118

Post by prawks »

Is a decent regex with dynamic yellow field coloration (and bolding for accessibility) accompanied by a message like "Your email address is of an unfamiliar format or may contain a typo" too intrusive? Then just allow the user to submit with that email without any automated validation.

It's not 100% idiot-proof, but I'd imagine it would be pretty effective for laypeople and hackers alike.

Re: Stop Validating Email Addresses With Your Complex Regex

#119

Post by anonyfuss »

nostromo wrote: post #90

I don't think this is good advice. From a previous startup we saw a ton of signups like, "john@gmail" and the like. Obviously this person will not get a validation email -- and in all likelihood will not be able to log in to his account when he returns. It's best to catch him when he's entering the information.

I think it's great advice; remember, the advice is: Stop Validating Email Addresses __With Your Complex Regex__. Remember that new TLDs are added, and that john@tld can actually be entirely valid.

If you want to prevent "john@gmail", then use a real RFC-compliant e-mail address parser, and attempt to resolve the domain component MX/A records (and remember, it might be an IP address).

If that fails (or your regex fails, or whatever validation you use), ____SUGGEST____ to the user that the address appears to be invalid. There's no reason for an overzealous registration form to refuse to accept the user's actual e-mail address.

Re: Stop Validating Email Addresses With Your Complex Regex

#120

Post by snowwrestler »

whirligig wrote: post #107
bane wrote: post #79

Earlier quoted context omitted.

Because most users couldn't type their own email address, or even a properly formatted email address to save their life. "My email address is joe.aol or was it aol.com@joe? Wait joeaol@com?"

I'd say nothing of value is lost in that case. These people are very costly to support. Email has been in common use for at least 20 years. They need to step up to the plate and learn at this point.

There are times when it is good business to stand on principle, and then there are times to just help your customers a little bit. Email signups are definitely the latter IMO.
Post reply on HN