Hacker News Reader

Comment by huhtenberg | Hacker News Reader

That was "Email validation for pedants".

Practically speaking, the following regex -

  /^[_\.0-9a-z-\+#]+@([0-9a-z][0-9a-z-]*\.)+[a-z]{2,6}$/i

coupled with a DNS check for domain name is yet to generate a single false negative in years that we've been using it across multiple projects.

(edit) Do read through the thread below before getting all downvote happy.

View on HN

Sorry, just broke your regex.

    hello@visit.melbourne.

Yes, that's a valid TLD now.

No, it's not - http://en.wikipedia.org/wiki/List_of_Internet_top-level_doma...

If you are referring to {2,6}, then it's easy to adjust once longer domains are put to actual use. If you are referring to the trailing dot, then that's exactly what I was saying - practically, email formats that are used by real people is a much simpler subset of what's permitted by the spec.

Yes, it is, or at least close enough that you should be considering it.

http://newgtlds.icann.org/sites/default/files/ier/hu62oef5uc...

gTLD can also contain punnycode/unicode now, which additionally breaks your regex in another way.

"Close enough" doesn't count :)

It does for all the irritated people that can't use their new domains on the tens of thousands of systems with rigid regex like this. Even if it's not breaking anything today, it's certain it will in the future.

It "doesn't count" for melborne TLD that currently sits in the "Initial Preapproval" state.

--

But more generally, you just don't want to hear what I'm saying.

Right now, people do NOT use email addresses with internationalized domains, they do NOT put trailing periods in domain names, etc. Once they start doing that, the regex can be adjusted to accommodate for that on first false rejection. As it exists now, the regex is tailored exactly to how emails are used now, by real humans. A negative is an indication of a bot activity or some other oddity that needs attention. Feel free to support that transparently, but the question is why would you want to do that.

> for that on first false rejection.

This assumes that you manually verify every rejection, or that they contact you. In other words: Either you're not using this anywhere with volume that matters, or you don't know that it hasn't caught false negatives.

> A negative is an indication of a bot activity or some other oddity that needs attention

High volume of negatives is an indication of bot activity or some other oddity. A single or handful of negatives is just humans going about their business as horrible typists.

If your volume is small enough that you can treat every negative as something to investigate, you really have no basis for saying anything about how well your regex works.

It's not the Gmail-level volume, but it's an email per day either. And yet there is still very few negatives, so it is possible to go through them by hand. Vast majority falls into "fafafa" and "test@test" category. The remainder is typos, e.g. commas instead of periods.

> A negative is an indication of a bot activity or some other oddity that needs attention. Feel free to support that transparently, but the question is why would you want to do that.

Why?:

It's very bad UX to say to a human "we don't support you because we think you just might be a bot".

I did actually use an interesting domain for a little while, but got completely fed up of it being rejected everywhere.

Why do you want so much to limit to 6, especially since you also do a DNS validation?

You should better lean on the permissive side; that would be one less thing to think about.

That kind of "validation" does not check for existing email addresses anyway, so there is not much value in trying to be strict in this area.

Yeah, I agree in principle, but it's at 6 simply because it works fine as is. Given new developments it might make sense to bump it up and/or add support for punycode, and we'll do it once it's actually needed.

What is the threshold where supporting a domain becomes important? It seems awfully arbitrary to say it "works fine as is" when it is disenfranchising millions of registered domains as it stands.

Forget new gTLDs, the current ones are tricky enough:

http://publicsuffix.org/

Amongst other problems, that limits TLDs to 6 characters, which is about 16 characters shy of the longest TLD right now in the DNS root zone: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

Add to that the fact it would fail on a legitimate top-level domain like .рф or .中国.

how do you test for false negatives?

By manually going through the log of rejected email addresses.

Reply on news.ycombinator.com