Advanced Email Address Verification

[gushy]

It's the age old subject of email address validation again, sorry.

I use javascript, and php to check the format of an address but that does not stop someone typing in a fake address.

I could use nslookup and parse the resulting utput to see if the domain exists, but that does not tell me if the mailbox exists.

Is there someway, perhaps making a connection via smtp and running a query, that I can find out if a domain exists and if the mailbox exists?

Regards,

-- Nick Gushlow

[Anon]

Actually, there is a Perl module that does more or less the same thing. I can't remember the name of it, I stumbled across it quite a while ago. A search on cpan should help find it. You could adapt the source to php quite easily, I would imagine.

The main thing to watch out for with implementing something like this would be the added time to submit the form. Not all the mailservers out there are snappy, and respond quickly. A bogged down mailserver may take minutes to respond. You would also have to deal with the case of someone submitting a valid email address at the time that their mailserver was down.

brad.

[nashirak]

The only thing you could possible do would be to check the mailbox (if on a unix account and if the port is open) is finger the user. But that still doesnt really cover ye ole' Hotmail, Yahoo etc... so the only way to do those is to do something very simple. Send and email to that address wait and see if the mailbox exists. (Somehow parse the return email to know that its not valid) . I do have one suggestion that I have seen companies start to do, and that is they will send you an email (if you sign up for something) but in order to activate whatever you signed up for or whatever, you have to click on a little link sent in the email.

Other than some neat little trick of doing a traceroute finding the guys IP hacking into his computer and finding out his real email address... I cant think of anything. 🙂

Hope that helps!

[[deleted]]

That is (and has been for a long time) a very common trick to get 'good' email adresses;

Just accept any email address that is properly formatted, then send an email to it asking the user to reply.
This has several advantages:
-If the email address does not exist you get a bounced message informing you that the email is not valid
- Spam blocker; The person who receives the email has to approve it by sending a reply. That way nobody can 'subscribe' people without their permission (you get only happy subscribers)
- Auto-unsubscribe; people can always send the 'remove' reply to remove themselves from the list.

[dannys]

You can also get the MX (Mail eXchange) records for a hostname with getmxrr(string hostname, array mxhosts [, array weight])

http://www.php.net/manual/en/function.getmxrr.php

This method isn't foolproof though (nothing to stop a valid hostname with an invalid username and it sometimes fails to pickup valid MX records so there's a small chance you could chuck out valid addresses.