confirm the e-mail address or the receive of the email

searain

I want to design a newsletter subscribers program.

Once a person sign in with a newsletter, the php program will send him a confirm newsletter.

I want to do this.

if the e-mail address is validated (not just a format validated, but validated to be real alive e-mail account) and the confirm e-mail is received, i want the php program receive an auto response, based on the response, the php program will actiavated the account if the e-mail account is validated and the confirm e-mail is received. If not, the php program will auto deleted the account.

my problem, how can php program know automatically that if the confirm e-mail is received by a validate account?

AstroTeg

Very good question - how would it know?

Lets back up a bit and instead of a PHP script, we have you doing this by hand. How would you know if the email was received or not? Are you referring to the receipt read email? You do know some email clients may not support this, or the user has this disabled, or the user chooses not to send the receipt. This could throw a wrench in your script.

I think a socialably acceptable method is to send a tagged link to the user. When they click the link (for "validation"), it goes to your site with a collection of parameters identifying the user. A PHP script the user goes to then takes care of registering that user. Otherwise, the user stays unregistered. You may decide to clean up the unregistered folks by using a cron job or scheduled task.

tekky

phpBB does this by inserting a randomly generated authvalue into the users DB record, then they send a link which includes this authkey and the page that they are linked to processes that value, sets it to '', once its set to '', that user is considered a valid user and can log in to the site

searain

http://whatismyipaddress.net/index.php/ev?PHPSESSID=0921519780be0045d4bef4fb7e891d0e

check this out, how did they do this? what is the method behind this?

tekky

RFC for SMTP and POP3 would probably offer some insight into that I seem to recall there being a VERIFY command for one of them....

AstroTeg

Originally posted by searain

check this out, how did they do this? what is the method behind this?

Ok, you can initiate a POP conversation with the mail server. Trick is, you still can not validate an email. The domain I am under comes up as "not recognized" for valid and invalid email addresses. You can not count on this method to verify email addresses, since the only way to really truely know if an email address works is to send it something. This method does not work because it would be a security risk if your email server did respond with a "valid"/"not valid" per email address (spammers would just test the email server for valid addresses instead of sending so much junk to everyone and everything).

One good thing you can do to validate/verify an email address is to do a DNS lookup on the mx record and make sure there's a server actually responsible for the domain in the email address. If no server is responsible (or doesn't respond), then you can consider that email address bad.

tekky

August 1982 RFC 821
Simple Mail Transfer Protocol

3.3. VERIFYING AND EXPANDING

  SMTP provides as additional features, commands to verify a user
  name or expand a mailing list.  This is done with the VRFY and
  EXPN commands, which have character string arguments.  For the
  VRFY command, the string is a user name, and the response may
  include the full name of the user and must include the mailbox of
  the user.  For the EXPN command, the string identifies a mailing
  list, and the multiline response may include the full name of the
  users and must give the mailboxes on the mailing list.

  "User name" is a fuzzy term and used purposely.  If a host
  implements the VRFY or EXPN commands then at least local mailboxes
  must be recognized as "user names".  If a host chooses to
  recognize other strings as "user names" that is allowed.

  In some hosts the distinction between a mailing list and an alias
  for a single mailbox is a bit fuzzy, since a common data structure
  may hold both types of entries, and it is possible to have mailing
  lists of one mailbox.  If a request is made to verify a mailing
  list a positive response can be given if on receipt of a message
  so addressed it will be delivered to everyone on the list,
  otherwise an error should be reported (e.g., "550 That is a
  mailing list, not a user").  If a request is made to expand a user
  name a positive response can be formed by returning a list
  containing one name, or an error can be reported (e.g., "550 That
  is a user name, not a mailing list").

  In the case of a multiline reply (normal for EXPN) exactly one
  mailbox is to be specified on each line of the reply.  In the case
  of an ambiguous request, for example, "VRFY Smith", where there
  are two Smith's the response must be "553 User ambiguous".

  The case of verifying a user name is straightforward as shown in
  example 3.

RFC 821 August 1982
Simple Mail Transfer Protocol

Just did a search for "SMTP RFC" on google, first link is to that quote above....

AstroTeg

Right... And as you read it you found:

If a host
implements the VRFY or EXPN commands then at least local mailboxes
must be recognized as "user names".

Trick is, it can be a security issue to allow these two commands so they tend to get disabled. Meaning you can't rely on the responses to these commands.

searain

So my understanding is that send a link to the subscribers and ask them to activate their account is the best soution.

The auto test is OK but if the mail server set up differently, it might not be working.

Thanks! That's what I was going to do, send a activate link, but I have to convince the team members that the auto approach such as the whatismyipaddress.net's approach is not working 100%. You guys have supplied me enough expertism here.

Thanks!