Lies we tell ourselves about email addresses • Hacker News Board

Re: Lies we tell ourselves about email addresses

#101

Post by JdeBP » Wed, Jun 10, 2026, 9:49 AM UTC

amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

I'm surprised that this has not triggered all of the reminiscences of sitting running mailq at intervals for hours to watch mail that hasn't even left the local sending machine yet.

Re: Lies we tell ourselves about email addresses

#102

Post by farfatched » Wed, Jun 10, 2026, 9:53 AM UTC

TZubiri wrote: post #64

farfatched wrote: post #10

> It’s likely that more people out there are being filtered by badly-implemented form validation than there are being filtered by their own need of hand-holding. I wish this was asserted with evidence. The author might suggest this because they have unrealistic views of some users. > In the year of our lord 2026, you can reasonably expect your users to know how to type their own email address - or even better, auto-i…

>I have multiple family members who have healthy memory, but can't accurately remember their email address everytime: the localpart, the domain, the syntax, everything. But you can't do anything about that except asking them to validate their address with an email. If you can catch 50% of user errors with some complex regex, but the other 50% such errors are uncaught, is that of any benefit during sofware design? No,…

> If you can catch 50% of user errors with some complex regex, but the other 50% such errors are uncaught, is that of any benefit during sofware design? No, because you still have to solve that problem, probably with email validation by code. You have reduced your workload by 0%, you just split it into 2 parts (unnecessarily).

In your example, the benefit is that users recover from the error 50% of the time at the time of registration, so it doesn't interrupt their workflow. Further, the fallback case (of contacting support, or enacting email validation, if a site chooses to implement) will see a dropoff in successful onboarding.

Re: Lies we tell ourselves about email addresses

#103

Post by account42 » Wed, Jun 10, 2026, 9:57 AM UTC

julian_t wrote: post #73

"Email addresses always have a 'normal' TLD" I registered a ".consulting" domain for my little company when they became available, and it has proved highly problematic ever since. Strangely (or perhaps not) it seems to be the larger players that have the most problems. I would at lest have expected ISPs and comms companies to keep up with this (looking at you, Three)

While on the sending site you should accept any domain, it's IMO irresponsible to use nuTLDs for pretty much anything as they are privately owned and you have zero recourse when the owner decides to change the deal on you.

Re: Lies we tell ourselves about email addresses

#104

Post by echoangle » Wed, Jun 10, 2026, 9:58 AM UTC

Maybe I'm taking this too lightly but honestly, if you're playing games with your email address and then don't get my verification mail, it's kind of a you problem. If your email address contains non-printable unicode characters or an IP address as the domain part, I don't really care enough to add support just for you. And surely everyone who does this has a "normal" email as a fallback anyways.

Re: Lies we tell ourselves about email addresses

#105

Post by account42 » Wed, Jun 10, 2026, 9:58 AM UTC

dijit wrote: post #78

julian_t wrote: post #73

"Email addresses always have a 'normal' TLD" I registered a ".consulting" domain for my little company when they became available, and it has proved highly problematic ever since. Strangely (or perhaps not) it seems to be the larger players that have the most problems. I would at lest have expected ISPs and comms companies to keep up with this (looking at you, Three)

I once worked for a company that had a .company gTLD but not the .com It was also a bloody nuisance. Spam filters were one thing but there were so many validation forms that failed. Every reasonable variation of the company name as a .com/.net/.org was taken, including company.com Ugh, what a nightmare. Domain holders are the landed gentry of tomorrow if we keep this up.

> Every reasonable variation of the company name as a .com/.net/.org was taken, including company.com

That also means that customers WILL confuse your company with others in non-domain contexts so perhaps it's a good idea to choose a more unique company name.

Re: Lies we tell ourselves about email addresses

#106

Post by account42 » Wed, Jun 10, 2026, 10:04 AM UTC

layer8 wrote: post #71

wolrah wrote: post #41

Earlier quoted context omitted.

That's why the article says "verify, not validate". Send an email, have a process for them to confirm they received it. If the user gets the email and completes the validation, the email is valid. If they fucked up, they don't get the email and the account never gets created. No one ever gets prevented from creating an account with a legitimate email address, as opposed to "opinionated validation" where that absolute…

While I’m opposed to opinionated validation as well, you seem to be missing the issue it tries to solve, which is the user mistyping their email address, not receiving the verification email, and either thinking everything is fine, or thinking that the process is borked, and in any case not proceeding and not becoming your customer. The goal of opinionated validation is to inform the user about an incorrect email add…

You could do soft validation that provides protection for common mistakes while still allowing users to use domains you didn't expect.

"Did you mean layer8@gmail.com instead of layer8@gmailc0m [Y][N]".

Re: Lies we tell ourselves about email addresses

#107

Post by farfatched » Wed, Jun 10, 2026, 10:08 AM UTC

trumpdong wrote: post #21

farfatched wrote: post #10

> It’s likely that more people out there are being filtered by badly-implemented form validation than there are being filtered by their own need of hand-holding. I wish this was asserted with evidence. The author might suggest this because they have unrealistic views of some users. > In the year of our lord 2026, you can reasonably expect your users to know how to type their own email address - or even better, auto-i…

There's something you can do in between - you can check the domain has an MX record.

Yes, and the MX check is pretty simple to implement.

But it is still lots more complicated than copying some imperfect email address regex, and for many sites, it's unlikely to even be worth spending much more effort than that.

Realistically, many sites can defacto choose to accept email addresses of few patterns. If a user's email address happens to be rejected, then they are either a non-technical user who quickly learns that they need a more commonly accepted email address, or a techie, who keeps a backup email address for these cases, and rightfully holds a grudge.

Most sites just aren't going to care enough to do anything more complex, for annoyed techies.

Re: Lies we tell ourselves about email addresses

#108

Post by FinnKuhn » Wed, Jun 10, 2026, 10:17 AM UTC

gerdesj wrote: post #13

Email is just like physical mail and thankfully just as endearingly human (sometimes). Once upon a time (1970/80s) I lived on and off in a mystic land called West Germany. Our postal addresses ended with incantations such as BFPO 40. Around 1985ish my granny send a Christmas card to us. I should note that she was at this time nearly seventy and sadly suffering from Parkinsons. She addressed the card, in rather crabbe…

When I was a child I sent a postcard to my grandparents. I forgot to put the house number and addressed the letter to "Oma und Opa" (Grandma and Grandpa). Logically it should not have been delivered successfully.

Thankfully though, the postal worker knew my grandparents had grandchildren and therefore just asked the potential recipients for the name of their grandchildren to determine, which grandparents the postcard was addressed to. To me it's still a miracle that it got delivered at all.

Re: Lies we tell ourselves about email addresses

#109

Post by account42 » Wed, Jun 10, 2026, 10:19 AM UTC

trumpdong wrote: post #21

farfatched wrote: post #10

> It’s likely that more people out there are being filtered by badly-implemented form validation than there are being filtered by their own need of hand-holding. I wish this was asserted with evidence. The author might suggest this because they have unrealistic views of some users. > In the year of our lord 2026, you can reasonably expect your users to know how to type their own email address - or even better, auto-i…

There's something you can do in between - you can check the domain has an MX record.

Technically you don't need an MX record to receive mail. From RFC 5321:

> If an empty list of MXs is returned, the address is treated as if it was associated with an implicit MX RR, with a preference of 0, pointing to that host.

I don't know if most MTAs allow this though.

Re: Lies we tell ourselves about email addresses

#110

Post by account42 » Wed, Jun 10, 2026, 10:22 AM UTC

TZubiri wrote: post #64

farfatched wrote: post #10

> It’s likely that more people out there are being filtered by badly-implemented form validation than there are being filtered by their own need of hand-holding. I wish this was asserted with evidence. The author might suggest this because they have unrealistic views of some users. > In the year of our lord 2026, you can reasonably expect your users to know how to type their own email address - or even better, auto-i…

>I have multiple family members who have healthy memory, but can't accurately remember their email address everytime: the localpart, the domain, the syntax, everything. But you can't do anything about that except asking them to validate their address with an email. If you can catch 50% of user errors with some complex regex, but the other 50% such errors are uncaught, is that of any benefit during sofware design? No,…

It is absolutely beneficial to catch 50% of errors earlier than you otherwise could. If validation fails the user is notified immediately. If you don't wait the user has to wait a bit in case the mail is just delayed.