Email Validation Rules

http://rumkin.com/software/email/rules.php

by nvr219 • 13 years ago

34 37 13 years ago

huhtenberg7• 13 years ago

That was "Email validation for pedants".

Practically speaking, the following regex -

  /^[_\.0-9a-z-\+#]+@([0-9a-z][0-9a-z-]*\.)+[a-z]{2,6}$/i

coupled with a DNS check for domain name is yet to generate a single false negative in years that we've been using it across multiple projects.

(edit) Do read through the thread below before getting all downvote happy.

nwh4• 13 years ago

Sorry, just broke your regex.

    hello@visit.melbourne.

Yes, that's a valid TLD now.

huhtenberg7• 13 years ago

No, it's not - http://en.wikipedia.org/wiki/List_of_Internet_top-level_doma...

If you are referring to {2,6}, then it's easy to adjust once longer domains are put to actual use. If you are referring to the trailing dot, then that's exactly what I was saying - practically, email formats that are used by real people is a much simpler subset of what's permitted by the spec.

nly2• 13 years ago

Forget new gTLDs, the current ones are tricky enough:

http://publicsuffix.org/

rincewind• 13 years ago

how do you test for false negatives?

huhtenberg7• 13 years ago

By manually going through the log of rejected email addresses.

kijeda2• 13 years ago

Amongst other problems, that limits TLDs to 6 characters, which is about 16 characters shy of the longest TLD right now in the DNS root zone: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

Add to that the fact it would fail on a legitimate top-level domain like .рф or .中国.

k33l0r• 13 years ago

I found this talk by Ricardo Signes on email parsing to be an excellent primer into why email addresses (and emails in general) are terrible to parse: http://youtu.be/JENdgiAPD6c

nly2• 13 years ago

Informative and entertaining, thanks.

old-gregg• 13 years ago

Yep. I'd like to add that some ESPs have their own additional restrictions on mailbox names, plus it's usually helpful to verify the existence of the domain part (DNS) because people make mistakes all the time.

We (Mailgun) have a free service which does all of these things: http://blog.mailgun.com/post/free-email-validation-api-for-w...

Sami_Lehtinen2• 13 years ago

It's also trival to contact recipient STMP server and check if it accepts rcpt to.

bkanber• 13 years ago

I feel like people really overthink email validation. I just look for an "@" and a ".". If you really need proof that an email address is valid, send an activation email. Otherwise, who cares if a few emails in your database are invalid?

Additionally, lots of 3rd party mail systems have some mechanism to notify you of bounced emails, so you'll figure out which are invalid at your first attempt anyway.

louischatriot• 13 years ago

Definitely, spending time validating email is useless. Look for an @ to make sure the user didn't mistake the email field for the name field and send him a confirmation email if you really want to be sure.

davefp• 13 years ago

I'd even drop the '.' requirement. Look for an @, then send a confirmation email. Done.

Sephr• 13 years ago

Requiring a dot breaks your form for people using bare TLD email or people using an IPv6 address instead of a domain.

cytzol• 13 years ago

There's a sufficient mass of people with dots in their e-mail addresses that it's worth checking for an at and a dot, even if you don't require it - just to check that they haven't typed a comma or something instead.

Sami_Lehtinen2• 13 years ago

There's no mention of minumum email length length, but I have noticed that some services do not accept email addresses like m(@)dy.fi or m(@)x.com etc. They claim that address is too short. Strip parenthesis from addresses.

elchief2• 13 years ago

Minimum should be 6: a@x.ca

Max is 254: http://stackoverflow.com/questions/386294/what-is-the-maximu...

mfwoods• 13 years ago

Strictly speaking, the minimum should be 4, because TLDs could accept email too (resulting in a@ca).

thrownaway2424• 13 years ago

The practical way to validate an email address is:

1: Does the domain part have either an MX or A record? 2: Does the address in that record accept mail? 3: Does the server that accepts mail at that address respond favorably to the local part as a RCPT TO argument?

If yes, it's a valid email address.

In particular this article is wrong that emails are always 7-bit. With SMTPUTF8 you can put whatever you want in there.

jwmerrill2• 13 years ago

Would you mind expanding on how to implement these steps, or do you know a good reference?

jwmerrill2• 13 years ago

Here's a gist showing the basic steps, using the unix utilities host and netcat: https://gist.github.com/jwmerrill/6502014

lucidrains• 13 years ago

does it really matter? there are sites that store your password in plain text and they manage to become big hits. there are sites that completely ignore current css design rules, and they do fine as well. why are you arguing over a problem that is basically 99% solved?

cbsmith• 13 years ago

It's funny that that is the easiest thing the author can do to summarize the rules.

I'd think a grammar (http://www.ietf.org/rfc/rfc2822.txt) would work just great.

ruricolist• 13 years ago

The HTML5 standard prescribes a regex for implementers to validate email addresses on the client side:

  /^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/

So if you're going to use <input type=email>, you might as well use the same check on the server side.

Email Validation Rules

Related Stories