Hacker News Reader

That's why the article says "verify, not validate". Send an email, have a process for them to confirm they received it.

If the user gets the email and completes the validation, the email is valid. If they fucked up, they don't get the email and the account never gets created.

No one ever gets prevented from creating an account with a legitimate email address, as opposed to "opinionated validation" where that absolutely will happen. Speaking from years of experience having a .info domain which isn't even all that odd, and at one point using gmail-style + addresses regularly. "Opinionated validation" has forced me to use my .com domain without a plus dozens of times.

I know part of this is intentional, those who know they plan to sell your email addresses don't want you to use the plus addresses, but that doesn't make the advice to not filter addresses any less correct.

While I’m opposed to opinionated validation as well, you seem to be missing the issue it tries to solve, which is the user mistyping their email address, not receiving the verification email, and either thinking everything is fine, or thinking that the process is borked, and in any case not proceeding and not becoming your customer. The goal of opinionated validation is to inform the user about an incorrect email address immediately when they are entering it, so they can correct it right away.

You could do soft validation that provides protection for common mistakes while still allowing users to use domains you didn't expect.

"Did you mean layer8@gmail.com instead of layer8@gmailc0m [Y][N]".

Indeed, “do you really mean that?” would be useful, though I would always have the user type the correction themselves, because too many users would select “Yes” without thinking or attentively verifying.

> I have multiple family members who have healthy memory, but can't accurately remember their email address everytime: the localpart, the domain, the syntax, everything.

I got Gmail early enough that I have (my first name) dot (my last name) at gmail dot com. About twenty years ago, I started getting strange emails. At first I thought they were spam, because they were addressed to me by name but I had never joined those sites. Eventually I figured out that they were addressed to (my first name) (my last name) at gmail dot com. Which Gmail treats as the same address as the one with a dot in between.

Since I had never ever given out a version of my email address without a dot in the middle, I eventually figured out that these emails were meant for someone else who shared the same first and last name as me. But since I don't think Gmail would allow one person to register john.example@gmail.com and then later allow someone else to register johnexample@gmail.com, my name doppelganger must have registered firstnamelastname@yahoo.com, and then forgot the domain and given out firstnamelastname@gmail.com when asked for an email address. And probably never noticed that they weren't receiving emails like "Dear customer, thank you for purchasing (product). Would you like to try (other product)?", so they never realized that they were giving out the wrong email address.

Randall estimates in the alt-text of https://xkcd.com/1279/ that there's about ¾ of a million people who just use somebody else's email on gmail without realizing it's not their email address.

I also have first.last@gmail.com (which I don’t use anymore, and just keep around), I get all kinds of private mails. Contracts, invoices, confidential material, private photos.

And of course, also automated signup mails, newsletters (which I make sure to block and report as spam, unsubscribing is a feature for newsletters that are opt-in), transactional mails etc.

People really suck at knowing what their e-mail is. The private mails are down to 1/month, the others to ~3/week, but it used to be much higher for both categories.

Oh and of course there is some kind of weird scam going on where spammers on German classifieds (Kleinanzeigen) send an e-mail to firstlast@gmail.com for whatever public first and last name of the lister is, and ask if the product is still available. No link, nothing. And all sent via gmail which has by an overwhelming majority become the biggest sender of spam for me. I guess they are trying to get someone to reply and then do some manual scam or something.

> my name doppelganger must have registered firstnamelastname@yahoo.com, and then forgot the domain

Alternative explanation: A hastily scribbled "@ymail.com" (along with its relative infrequency) can look to many people like "@gmail.com".

Hey! Neat to see some more folks that have a story to tell about the oerhaps unintended side effects of the way the dot was implemented in gmail addresses.

Reading these dot-related comments reminded me that I once made one here about how I was able to leverage this possibly asynchronous dot-handling at gmail. Because the story is a bittersweet sentimental one for me I had to go back and read it now, and though I am sitting here with bad allergies streaming down my face, it also felt really nice to remember that.

I know this is a bit of a sideways comment, and I apologize for that but it isn't often I am overcome with emotion on HN, or on the topic of email addressing, and well, I appreciated the opportunity to re-read it now. Thanks.

You might find my gmail dots story interesting too. It's a little long, but the dot-character portion begins about a third of the way down in my comment:

https://news.ycombinator.com/item?id=46539424#46541149

Cheers!

There's something you can do in between - you can check the domain has an MX record.

Yes, and the MX check is pretty simple to implement.

But it is still lots more complicated than copying some imperfect email address regex, and for many sites, it's unlikely to even be worth spending much more effort than that.

Realistically, many sites can defacto choose to accept email addresses of few patterns. If a user's email address happens to be rejected, then they are either a non-technical user who quickly learns that they need a more commonly accepted email address, or a techie, who keeps a backup email address for these cases, and rightfully holds a grudge.

Most sites just aren't going to care enough to do anything more complex, for annoyed techies.