Valid Email Addresses

http://en.wikipedia.org/wiki/Email_address#Valid_email_addresses

by ry0ohki • 14 years ago

50 59 14 years ago

en.wikipedia.org

nthitz3• 14 years ago

I don't care for overaggressive email validators myself, but if you are registering with my service using an email of ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" I'll probably want you to enter something more reasonable.

Anyway just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address.

jacquesm3• 14 years ago

I guess I won't be using your service then! Quite frequently I find that services will not accept my perfectly valid email address as valid. This is on the whole their loss, since if they can't even properly validate an email address there are probably more loose ends and I'd rather not find out which.

bwilliams• 14 years ago

It's a bit extreme to correlate not being able to validate an email address (that isn't in a common format) to having other loose ends.

digitalsushi2• 14 years ago

On the whole, it's probably not a loss. It's probably a gain. On the whole, they validated almost all of the email addresses. They spent their corner case money instead on making the product awesome, and instead of poor []:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org getting a copy, everyone else got something better.

rsenk330• 14 years ago

I run into this a lot using a "+" in my Gmail address. I like to use "username+site_name@gmail.com" for easy filtering, but there are still quite a large number of sites that do not accept this as valid, and it is extremely annoying.

lanstein• 14 years ago

I remember what it is, and you're completely right - it's certainly legitimate and legible (though unusual ;) ).

nthitz3• 14 years ago

Accepting "()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org versus accepting j@ww.com

Hardly a valid comparison. Yes my theoretical non existant service would validate addresses like yours. That is vastly different to the one I mentioned.

dfc3• 14 years ago

"just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address."

I'm sorry but abiding by the RFC is the definition of a valid email address.

Postel said it best "be conservative in what you do, be liberal in what you accept from others."

tbrownaw• 14 years ago

A "valid" email address does not have to mean a "well-formed" email address.

nthitz3• 14 years ago

Just because myname@xyz.com is valid according to the RFC does not mean xyz.com is an existing domain name with a mail server setup that an account 'myname', let alone that user who inputted actually has access to that account. Just send a validation email

dutchbrit• 14 years ago

For people validating emails in PHP, use the following code:

filter_var($email, FILTER_VALIDATE_EMAIL);

The actual beast: https://github.com/php/php-src/blob/master/ext/filter/logica...

ry0ohki• 14 years ago

oh wow had no idea that existed, thank you!

jneen• 14 years ago

Why do email addresses need comments again?

digitalsushi2• 14 years ago

It helps you remember to whom you gave the address. mikec+farmville@digitalsushi.com is a nice comment that tells me "I used this for farmville; who is now emailing me with it?"

ben0x539• 14 years ago

A malicious sender could just strip out your +whatever, and then you are where you started, unless you already filter all mail without a + part and give all your friends a salted email address.

eli4• 14 years ago

No, that's not a comment. That plus sign is part of the email address. It's up to your mail server how to figure out how to parse it and stuff it into the correct inbox.

The RFC allows for actual nested comments to appear within the address. Though nobody actually uses this and really the RFC is talking about formatting for email messages in transit, not how you should or shouldn't record your address on a form.

jimktrains2• 14 years ago

I don't think that's what OP meant. You can have comments like first.last(notify IM)@example.com see http://blog.dominicsayers.com/2009/02/27/comments-in-email-a...

I just don't understand why they made the spec so complex. Seriously, indefinably nestable comments?

spindritf• 14 years ago

> Invalid email addresses

> Abc.example.com (an @ character must separate the local and domain parts)

Well, that also depends on the context because replacing @ with a dot is exactly what you'd do in a zone file:

    $ dig soa google.com +short
    ns1.google.com. dns-admin.google.com. 2012113000 7200 1800 1209600 300

So it gets even hairier.

duskwuff• 14 years ago

Well, yes. But at that point it's no longer an email address.

neya• 14 years ago

There's a reason why most of those valid email addresses are not allowed by most email providers. As an example, in the 1997-early 2000's, underscores were very popular amongst the internet users and most of them had an underscore in their E-mail addresses. Whilest applying for a job, they would fill out a form in the employer's website/some form application software where the data is then later tabulated.

Once tabulated, the entire email address would be underlined by many popular softwares back then, since it's (was) essentially considered as a link. Then, while the recruiters were trying to copy and paste these prospective e-mail ID's in their respective email clients, the underscore would be missed out and would have just a space instead (which the recruiters have no idea as to why) and thus the recipients would miss out from receiving these emails. Hence, many email providers wouldn't allow one to register an underscore (or any complex character) after receiving many such reports, just to avoid these hassles.

alpb• 14 years ago

Here's what a RFC-compliant email address regex looks like: http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html

Hint: God damn long.

eli4• 14 years ago

It's weird how often email address validation comes up on HN. I think it must be bike shedding for the web app generation. It's the simplest piece of a common web app for which there could possibly be any discussion or disagreement.

Yes, you can have a crazy looking email address. But that doesn't mean you should. And you have no right to expect a web form will let you enter your address with nested comments.

On the other hand, a lot of developers seem to confuse validating an email address against the RFC with confirming that it is the user's true and correct address. This is not possible without sending the address a message. Regardless of how good your regex is, it will let many typos through and it will fail to stop "fake@fake.com". I'd suggest spending time elsewhere.

meritt• 14 years ago

Agreed.

When damn near every application today requires the user to click a link sent to their email, I can't envision any reason for actually validating the email at form submission time (except len <= 254). If they click the activation link, it's a legitimate user. End of story.

dbaupp• 14 years ago

And inclusion of @.

bjt• 14 years ago

If you're trying to optimize a registration process, you want to minimize the number of people you lose at each step. If someone gives you a bad email address, and then you try to send the activation link there, you've lost that registration. If you catch it when they submit the form then you've got a better shot at getting a complete registration from that user.

haberman2• 14 years ago

> And you have no right to expect a web form will let you enter your address with nested comments.

While nested comments are a bit extreme, I'm not a fan of the attitude that a user has "no right" to use features that are a documented part of the spec. Just because a feature is uncommon or doesn't seem important to you doesn't mean it's not important to some small subset of your users.

For example, that's not far from saying that a user has "no right" to put +tag in their email address (after all barely anyone uses that), but some people find this extremely valuable.

eli4• 14 years ago

I meant it in the spirit of Postel's Law [1]

[1] http://en.wikipedia.org/wiki/Robustness_principle

saurik2• 14 years ago

No, nested comments are not part of "the" spec (in a way that would imply "the e-mail spec"); sure, they are a feature of "a" spec, but that spec is actually somewhat unrelated to what an e-mail address actually is: they are just a feature of the MIME specification for header field values.

If you look at the SMTP specification (which, given that it defines the protocol in charge of using e-mail addresses for actual delivery has a much better claim to being "the" spec), you will note that you aren't allowed to use an e-mail address with nested comments in that context, as they have no meaning to SMTP.

However, you will also find that the rules for what characters are allowed and which have to be escaped are different, as that's what these specifications are actually discussing: how to escape an e-mail address for use with specific transport protocols.

An actual e-mail address? It seems to support pretty much anything followed by an @ followed by a domain name. It is just that in MIME, if you want to have a space character you will need to put it in quotes, or if you want a quote you will need to use a backslash.

The user of your web form, of course, is not typing MIME: there is a box that they can just type their e-mail address into, and it should probably support the raw syntax of their actual e-mail address, not a randomly chosen format required for escaping.

To make this more clear, one has to ask: why MIME escaping? Why not require the user to use HTML attribute escape sequences? That way, if their e-mail address contains a special character, instead of using quotation marks and backslash escaping, they'd use entities, like """.

Honestly, that makes about as much (if not more) sense. Meanwhile, of course, the user's username and password fields should also be escaped similarly, and if the user attempts to the use a bare < or > they should get a validation error "please escape your password using RFC1866 (HTML)".

Previous, more detailed versions of this same complaint:

http://news.ycombinator.com/item?id=4794368

http://news.ycombinator.com/item?id=4486872

nofinator• 14 years ago

Someone should update this McSweeney's list: http://www.mcsweeneys.net/articles/e-mail-addresses-it-would...

edmond_dantes• 14 years ago

A contemporary "Who's on first?" scenario.

unreal37• 14 years ago

I had no idea that email addresses could be so complex. ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" is valid?

It won't be a popular view around here, but that SHOULDN'T be valid. The spec needs to change. I won't be making changes to any of the large sites that my company manages to accept weird characters like brackets, semicolons and quotation marks as a valid email address. That's just asking for a XSS or SQL injection attack and other trouble.

Sorry, but the spec is just wrong here.

mcguire2• 14 years ago

This is probably not a popular view around here either, but if you're examining the contents of the string to avoid XSS or SQL injection attacks, you're doing it wrong.

mrb• 14 years ago

You sound like a lazy developer who doesn't want to learn the proper way to protect against XSS and SQL injection. If you have this mentality, your code probably has similar vulnerabilities in pieces of data other than the email address.

Valid Email Addresses

Related Stories