Hacker News Reader

Comment by charles_f | Hacker News Reader

The only way to validate an email is to send a message to the email address. Validating that it fits the rfc is pointless, because a) its very easy to create an email that is both false and meets the rfc, b) email provider might bypass the rfc and the email would still be working.

To validate user input, I use that: /^[^@]+@[^.]+\..+$/. It's doesn't tell me if the email is semantically correct per the rfc because I'm not running an rfc correctness validation service. What I want is to make sure that users didn't input their name in the email field. This tells me if it ressembles an email

View on HN

It's the difference between type checking and business logic validation.

E.g., Type check that the user's name is a String and then let the database/business-logic yell at you when it's not unique.

In this case, checking that an email address input is "shaped" like 'not-empty@not-empty' is the "type check", and then actually sending an email is the only way for your business logic to know if it's actually valid.

It isn’t pointless. It is fast feedback for typos and form validation

The parent's regular expression covers the most egregious typos without making any assumptions about domain names or tlds. If you wanted to help out with common typos you could add additional logic to specifically check for "*@gmial.com" or other permutations of the common domains. If you wanted to get really fancy, you could even run it by an edit distance function against the common domains and warn if they're close to a common one but not quite there.

Most typos, however, are likely to be in the first part, not in the domain. The only real way to validate against those is to try the address and see.

It misses the very common mistake of typing a comma instead of a dot.

Otherwise, yeah, most people would be better served by a library that detects domain typos like https://github.com/mailcheck/mailcheck than spending time on regexes.

A small subset of typos. bob@mail.com and bob@mial.com will pass the same validation rules.

A regex won't catch typos. Send an email, or if you really want force to enter twice. The rfc is both so permissive and generic that pretty much anything will pass it, while at the same time it is very hard to test it, so you might block legitimate ones. MSFT for example allows you to use your personal email as a MSFT account. If you username is less than 3 letters some of the validation they do in some of the subsystems will reject it as invalid that they even validated with a confirmation email. I can't count the number of systems which reject + in a username or a subdomain in the host. Truly you're just making it harder for the users and for yourself.

But the proof of the validation is in the sending. If it’s important I send a validation email

There is some value in reducing the number of bad emails sent out, because email providers don't like it if you send large numbers of emails to bad addresses. So if you can help someone get their email right the first time, it's worthwhile, as long as the mechanism you use isn't overbearing.

Reply on news.ycombinator.com