Question

I am working on a web app that requires me to check if the users email are valid and exists. (I do the regex check) The question is what is best practice of verifying that an email exists?

Here are some options that I have though about:

send an email to the user and make them confirm the email address
do a VRFY SMTP - is this still used? should i bother looking into it?
any other good idea?

Answer 1

sending a verification email to the user verifies that the email is valid and that the user is the owner of the account

Answer 2

Doing a regex check on an email address can be frustrating for some users, depending upon the regex. In my case, I have several domains where all of the addresses are delivered to a single mailbox, so I can use the address to specify the sender (for filtering). Here are some valid (per RFC 2822) address patterns that I have had rejected by various websites:

foo@example.name
foo@example.info
foo+sitename@example.org
foo-sitename@example.com

I recommend that you skip your regex test and just send the verification email with a confirmation link -- anything else will leave your application brittle and subject to breakage as soon as someone comes up with a new DNS or SMTP extension.

PS: ICANN is expected to approve UNICODE domain names Real Soon Now. That will play merry hell with Regex patterns for email addresses.

Answer 3

Not an answer to your question, but I d like to quote someone on reddit:

Validating an email address using nothing but a regular expression is like building a house using nothing but a power drill.

This is the only RFC-valid way to do it:

[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80- xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x80-xf f
15()]*)*)[40	]*)*(?:(?:[^(40)<>@,;:".\[]00-37x80-x ff]+(?![^(40)<>@,;:".\[]00-37x80-xff])|"[^\x80-xff
15 "]*(?:\[^x80-xff][^\x80-xff
15"]*)*")[40	]*(?:([^\x80- xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80 -xff][^\x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]* )*(?:.[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^ \x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\ x80-xff
15()]*)*)[40	]*)*(?:[^(40)<>@,;:".\[]00-37x8 0-xff]+(?![^(40)<>@,;:".\[]00-37x80-xff])|"[^\x80-xff
 15"]*(?:\[^x80-xff][^\x80-xff
15"]*)*")[40	]*(?:([^\x 80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^ x80-xff][^\x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40 	]*)*)*@[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([ ^\x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^ \x80-xff
15()]*)*)[40	]*)*(?:[^(40)<>@,;:".\[]00-37 x80-xff]+(?![^(40)<>@,;:".\[]00-37x80-xff])|[(?:[^\x80- xff
15[]]|\[^x80-xff])*])[40	]*(?:([^\x80-xff
15() ]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\ x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]*)*(?:.[4 0	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff n15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x80-xff
 015()]*)*)[40	]*)*(?:[^(40)<>@,;:".\[]00-37x80-xff]+(?! [^(40)<>@,;:".\[]00-37x80-xff])|[(?:[^\x80-xff
15[ ]]|\[^x80-xff])*])[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^ x80-xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
1 5()]*)*))[^\x80-xff
15()]*)*)[40	]*)*)*|(?:[^(40)<>@,;:". \[]00-37x80-xff]+(?![^(40)<>@,;:".\[]00-37x80-xff] )|"[^\x80-xff
15"]*(?:\[^x80-xff][^\x80-xff
15"]*)*")[^ ()<>@,;:".\[]x80-xff00-1012-37]*(?:(?:([^\x80-xff
 15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80-xff][ ^\x80-xff
15()]*)*))[^\x80-xff
15()]*)*)|"[^\x80-xff n15"]*(?:\[^x80-xff][^\x80-xff
15"]*)*")[^()<>@,;:".\[] x80-xff00-1012-37]*)*<[40	]*(?:([^\x80-xff
15()]*(? :(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\x80- xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]*)*(?:@[40	]* (?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15 ()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x80-xff
15() ]*)*)[40	]*)*(?:[^(40)<>@,;:".\[]00-37x80-xff]+(?![^( 40)<>@,;:".\[]00-37x80-xff])|[(?:[^\x80-xff
15[]]|\ [^x80-xff])*])[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80- xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]* )*))[^\x80-xff
15()]*)*)[40	]*)*(?:.[40	]*(?:([^\x80 -xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x 80-xff][^\x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40	 ]*)*(?:[^(40)<>@,;:".\[]00-37x80-xff]+(?![^(40)<>@,;:".\ []00-37x80-xff])|[(?:[^\x80-xff
15[]]|\[^x80-xff]) *])[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\x 80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x80 -xff
15()]*)*)[40	]*)*)*(?:,[40	]*(?:([^\x80-xff
15( )]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\ x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]*)*@[40	 ]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
 15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x80-xff
15 ()]*)*)[40	]*)*(?:[^(40)<>@,;:".\[]00-37x80-xff]+(?![^( 40)<>@,;:".\[]00-37x80-xff])|[(?:[^\x80-xff
15[]]| \[^x80-xff])*])[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80 -xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15() ]*)*))[^\x80-xff
15()]*)*)[40	]*)*(?:.[40	]*(?:([^\x 80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^ x80-xff][^\x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40 	]*)*(?:[^(40)<>@,;:".\[]00-37x80-xff]+(?![^(40)<>@,;:". \[]00-37x80-xff])|[(?:[^\x80-xff
15[]]|\[^x80-xff ])*])[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\ x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x 80-xff
15()]*)*)[40	]*)*)*)*:[40	]*(?:([^\x80-xff
15 ()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^ \x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]*)*)?(?:[^ (40)<>@,;:".\[]00-37x80-xff]+(?![^(40)<>@,;:".\[]00- 37x80-xff])|"[^\x80-xff
15"]*(?:\[^x80-xff][^\x80-xff n15"]*)*")[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]| ([^\x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*)) [^\x80-xff
15()]*)*)[40	]*)*(?:.[40	]*(?:([^\x80-xff 
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80-x ff][^\x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]*)*( ?:[^(40)<>@,;:".\[]00-37x80-xff]+(?![^(40)<>@,;:".\[] 000-37x80-xff])|"[^\x80-xff
15"]*(?:\[^x80-xff][^\x80- xff
15"]*)*")[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-x ff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*) *))[^\x80-xff
15()]*)*)[40	]*)*)*@[40	]*(?:([^\x80-x ff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80- xff][^\x80-xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]*) *(?:[^(40)<>@,;:".\[]00-37x80-xff]+(?![^(40)<>@,;:".\[ ]00-37x80-xff])|[(?:[^\x80-xff
15[]]|\[^x80-xff])*] )[40	]*(?:([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80- xff
15()]*(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x80-x ff
15()]*)*)[40	]*)*(?:.[40	]*(?:([^\x80-xff
15()]*( ?:(?:\[^x80-xff]|([^\x80-xff
15()]*(?:\[^x80-xff][^\x80 -xff
15()]*)*))[^\x80-xff
15()]*)*)[40	]*)*(?:[^(40)< >@,;:".\[]00-37x80-xff]+(?![^(40)<>@,;:".\[]00-37x8 0-xff])|[(?:[^\x80-xff
15[]]|\[^x80-xff])*])[40	]*(?: ([^\x80-xff
15()]*(?:(?:\[^x80-xff]|([^\x80-xff
15()] *(?:\[^x80-xff][^\x80-xff
15()]*)*))[^\x80-xff
15()]*) *)[40	]*)*)*>)

So let s not.

Answer 4

Sending them an e-mail forcing them to press a confirmation link is the best option, as there s always the chance that their SPAM filter will block your mails. It s best to get that dealt with when their paying attention.

Answer 5

In Perl there is a nice module called Email::Valid which can check the email address for valid formation, and optionally check the email address s domain for an MX record.

Answer 6

function EmailValidation($email)
{
$email = htmlspecialchars(stripslashes(strip_tags($email))); //parse unnecessary characters to prevent exploits
if ( eregi (  [a-z||0-9]@[a-z||0-9].[a-z] , $email ) )
{ //checks to make sure the email address is in a valid format
$domain = explode( "@", $email ); //get the domain name
if ( @fsockopen ($domain[1],80,$errno,$errstr,3))
{
//if the connection can be established, the email address is probably valid
return true;
} else
{
return false; //if a connection cannot be established return false
}
return false; //if email address is an invalid format return false
}
}

友情链接