11 ms·

I've accepted that it's best to treat people like grown-ups and if there's '@' and '.' and it's retyped then it passes. Someone can easily submit a fake name or

by percept 16y ago

I've accepted that it's best to treat people like grown-ups and if there's '@' and '.' and it's retyped then it passes. Someone can easily submit a fake name or phone number or street address, and e-mail's no different. If they get it wrong, intentionally or not, then they don't get their receipt, confirmation, validation link, etc. and I believe in most cases the incentive is there for them to get it right. In the rare case where there's some incentive to circumvent the system and this has some measurable impact on a site, then more validation may be warranted. Otherwise, why worry about it? Also: HTML5. ;)

jbr 16y ago
Along those lines, I've settled on the following overly permissive regex: /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/ -- it makes sure it looks something like an email address (a@b.cd)
- jrockway 16y ago
  What if I want to receive mail directly at my TLD?
  - DougBTX 16y ago
    Interestingly, there is a test for that in the article - under the "These should be invalid" section.
  - _fool 16y ago
    interestingly i count 19 TLD's with mx records. but judging from your earlier post you know as well as i do (i use <single character>@w.tf for many purposes) that there are pretty much no web forms on the planet that would take such an address. tis a shame, but such addresses while pretty nifty are also frequently unusable. not to mention trying to explain to someone that that is really your email address and if it doesn't work they should talk to their ISP/mail client author/etc...well, suffice it to say they won't be getting in touch with you that way anyhow. (be that a blessing or curse, it's just reality)
  - davidu 16y ago
    Except it's not allowed... http://tools.ietf.org/html/rfc5321#section-2.3.5 http://tools.ietf.org/html/rfc5321#section-2.3.5 RFC 5321 section 2.3.5 specifically prohibits TLDs from receiving email. Other RFCs back that up, actually including RFC5322 (not directly, but in wire format). That said, we see some TLDs run MX's. I think at least some portion of them sell the mail received there to spammers. Seriously.
    - tav 16y ago
      Hey David, You obviously know a lot more on this topic... but where exactly does it say in that section that TLDs are prohibited from receiving emails? From my reading, it seems to suggest the opposite, e.g. "In the case of a top-level domain used by itself in an email address, a single string is used without any dots." I've re-read that section many times and forgive me if I missed it — it's late! =) People have been posting conflicting responses throughout this thread suggesting that TLDs can/cannot receive emails, and I'd really like to know which should be valid... thanks!
- mike-cardwell 16y ago
  What if my email address is: "@"@example.com ?
  - mattmanser 16y ago
    Then you should be taken outside and shot as you probably set it up yourself. ;)
pornel 16y ago
Retyped!? Grown-ups can read what they write. Retyping only makes sense for password field, which is obfuscated and doesn't allow copy&paste.
- jeff18 16y ago
  I would estimate about 0.25% of people will make a typo like "@homail.com" or "@gmial.com" Multiply that by say, 130,000 people, and you are dealing with 325 people who don't receive their download, etc. and are not happy! I think what would be really awesome is a regex that catches these common typos and warns the user immediately.
  - Zak 16y ago
    You'd need something more along the lines of a spell checking algorithm to do that sanely. Don't abuse regular expressions for things they're not good at.
    - tgandrews 16y ago
      Yeah, that python script (from StackOverflow London - http://norvig.com/spell-correct.html http://norvig.com/spell-correct.html) that learned what was correct from a large number of words would work. Analyse your DB of users' email address url (after @) that have registered fully and provide a "Did you mean.." type response if a new users email url was not found and something close (within 2 alterations) to it was.
  - mhartl 16y ago
    True, but you have to balance that against the small but nonzero number of people put off by an extra text field. Plus, I would find email repetition more annoying if I didn't always do Cmd-A/Cmd-C/Tab/Cmd-V, and in this case the repeated field won't catch any errors.
    - sjs 16y ago
      The fact that you know the shortcuts for select all, copy, and paste puts you in the top percentile of users. Most people don't even know that's possible, and certainly not with keyboard shortcuts. (The point being that for most users the faster approach that requires less thinking is to type it twice. Sometimes I do things the "slow" or "long" way when coding because it doesn't require a mental shift from the task at hand.)
sgk284 16y ago
I also do simple email verification: 1) Send an email to the address. 2) If it succeeds, the address was valid.
- Confusion 16y ago
  In which you are assuming you will receive a proper bounce, which is not warranted. Checking bounces is something you can do in addition to checking whether the user didn't screw up his email address.
  - danielharan 16y ago
    If a person clicks on a confirmation link, then the email got through OK.
- stingraycharles 16y ago
  So what happens when a mailserver uses greylisting to filter spam ?
  - jauer 16y ago
    Your outbound mailserver retries later and the message is delivered?
jrockway 16y ago
My thoughts exactly. There are so many websites that tell me my valid email address is invalid that it's not even funny. These people then have to deal with phonecalls and lost business, because their form won't even submit without a valid email address (and why should I change if they're the ones that suck). BTW, the email address that doesn't work is "jon-whatever@jrock.us". The .us confuses people and the - confuses people. WTF!?
- KERMIT 16y ago
  I've seen code written in India that disallowed any email address containing one or more digits. This was on a site accepting email addresses from the general public, as well.
- Confusion 16y ago
  The have a lot more problems to deal with if they have to deal with all the people that include a stray space in the address. There are regexes out there that catch all valid addresses that people reasonably use (including those with dashes and ending in .us) and the fact that all kinds of incompetent developers use a homebrewn regex is no reason to lower the best case scenario to "just don't validate". Just do it right.
fhars 16y ago
Your recommendation is almost as wrong as the regexp in the article, as both will reject the perfectly valid postmaster@ai address (check it out, "dig -t mx ai" will return a result, so that address must exist). The only thing you can be sure about in a non-local email address is that it contains at least one @ sign. More are allowed (for source routing), but hopefully no server is still configured to honor that, so you might get away with requiring exactly one @. Everything else is evil. Oh, and don't forget to make sure that one component in your spam^W email processing chain correctly encodes unicode charaters in the domain part into punycode.
Zev 16y ago
There are more reasons to check for an email than simply validation. Perhaps you want to detect emails in a field and let people click/tap on them to send that person an email? Don't want to let people send email off to foo@bar.baz now, do we?
richardw 16y ago
There are many other uses for this regex than registration systems. We have at least two situations where a staff member would type in a customer mail address, and some get it wrong. Confirming won't help, and getting it wrong costs lots of time to fix. Using a better regex costs very little.
Confusion 16y ago
If they get it wrong, intentionally or not, then they don't get their receipt, confirmation, validation link, etc. and I believe in most cases the incentive is there for them to get it right. Well, I hope you have a large enough support team, because with any reasonable amount of customer growth, you'll soon be swamped with support emails that say "I didn't get my ..., where is it? You suck!". Validating the email address (which includes checking for common typos in domains) is a service that reduces frustration and the amount of customer support needed.
- ryan-allen 16y ago
  Even if they've typed it correctly it still can be blocked for various reasons. You will still need a support mechanism (doesn't have to get all the way to a person) to sort out undelivered verification mails. It's just how it goes.
  - sstrudeau 16y ago
    Still, some rudimentary validation can prevent cases of someone entering the wrong value (e.g., just their username) or an incomplete value (e.g., scott.trudeau@gmail ) -- which I see with some regularity ~10k signups/month. If this lowers support email volume by even just 10%, that's not insignificant.
Chilijoe 16y ago
You assume an email regex is only used for validating addresses. It can also be used to parse text for email addresses (for formatting or mining purposes maybe).

by percept 16y ago

jbr 16y ago

Along those lines, I've settled on the following overly permissive regex: /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/ -- it makes sure it looks something like an email address (a@b.cd)

jrockway 16y ago
What if I want to receive mail directly at my TLD?
- DougBTX 16y ago
  Interestingly, there is a test for that in the article - under the "These should be invalid" section.
- _fool 16y ago
  interestingly i count 19 TLD's with mx records. but judging from your earlier post you know as well as i do (i use <single character>@w.tf for many purposes) that there are pretty much no web forms on the planet that would take such an address. tis a shame, but such addresses while pretty nifty are also frequently unusable. not to mention trying to explain to someone that that is really your email address and if it doesn't work they should talk to their ISP/mail client author/etc...well, suffice it to say they won't be getting in touch with you that way anyhow. (be that a blessing or curse, it's just reality)
- davidu 16y ago
  Except it's not allowed... http://tools.ietf.org/html/rfc5321#section-2.3.5 http://tools.ietf.org/html/rfc5321#section-2.3.5 RFC 5321 section 2.3.5 specifically prohibits TLDs from receiving email. Other RFCs back that up, actually including RFC5322 (not directly, but in wire format). That said, we see some TLDs run MX's. I think at least some portion of them sell the mail received there to spammers. Seriously.
  - tav 16y ago
    Hey David, You obviously know a lot more on this topic... but where exactly does it say in that section that TLDs are prohibited from receiving emails? From my reading, it seems to suggest the opposite, e.g. "In the case of a top-level domain used by itself in an email address, a single string is used without any dots." I've re-read that section many times and forgive me if I missed it — it's late! =) People have been posting conflicting responses throughout this thread suggesting that TLDs can/cannot receive emails, and I'd really like to know which should be valid... thanks!
mike-cardwell 16y ago
What if my email address is: "@"@example.com ?
- mattmanser 16y ago
  Then you should be taken outside and shot as you probably set it up yourself. ;)

pornel 16y ago

Retyped!? Grown-ups can read what they write. Retyping only makes sense for password field, which is obfuscated and doesn't allow copy&paste.

jeff18 16y ago
I would estimate about 0.25% of people will make a typo like "@homail.com" or "@gmial.com" Multiply that by say, 130,000 people, and you are dealing with 325 people who don't receive their download, etc. and are not happy! I think what would be really awesome is a regex that catches these common typos and warns the user immediately.
- Zak 16y ago
  You'd need something more along the lines of a spell checking algorithm to do that sanely. Don't abuse regular expressions for things they're not good at.
  - tgandrews 16y ago
    Yeah, that python script (from StackOverflow London - http://norvig.com/spell-correct.html http://norvig.com/spell-correct.html) that learned what was correct from a large number of words would work. Analyse your DB of users' email address url (after @) that have registered fully and provide a "Did you mean.." type response if a new users email url was not found and something close (within 2 alterations) to it was.
- mhartl 16y ago
  True, but you have to balance that against the small but nonzero number of people put off by an extra text field. Plus, I would find email repetition more annoying if I didn't always do Cmd-A/Cmd-C/Tab/Cmd-V, and in this case the repeated field won't catch any errors.
  - sjs 16y ago
    The fact that you know the shortcuts for select all, copy, and paste puts you in the top percentile of users. Most people don't even know that's possible, and certainly not with keyboard shortcuts. (The point being that for most users the faster approach that requires less thinking is to type it twice. Sometimes I do things the "slow" or "long" way when coding because it doesn't require a mental shift from the task at hand.)

sgk284 16y ago

I also do simple email verification: 1) Send an email to the address. 2) If it succeeds, the address was valid.

Confusion 16y ago
In which you are assuming you will receive a proper bounce, which is not warranted. Checking bounces is something you can do in addition to checking whether the user didn't screw up his email address.
- danielharan 16y ago
  If a person clicks on a confirmation link, then the email got through OK.
stingraycharles 16y ago
So what happens when a mailserver uses greylisting to filter spam ?
- jauer 16y ago
  Your outbound mailserver retries later and the message is delivered?

jrockway 16y ago

My thoughts exactly. There are so many websites that tell me my valid email address is invalid that it's not even funny. These people then have to deal with phonecalls and lost business, because their form won't even submit without a valid email address (and why should I change if they're the ones that suck). BTW, the email address that doesn't work is "jon-whatever@jrock.us". The .us confuses people and the - confuses people. WTF!?

KERMIT 16y ago
I've seen code written in India that disallowed any email address containing one or more digits. This was on a site accepting email addresses from the general public, as well.
Confusion 16y ago
The have a lot more problems to deal with if they have to deal with all the people that include a stray space in the address. There are regexes out there that catch all valid addresses that people reasonably use (including those with dashes and ending in .us) and the fact that all kinds of incompetent developers use a homebrewn regex is no reason to lower the best case scenario to "just don't validate". Just do it right.

fhars 16y ago

Your recommendation is almost as wrong as the regexp in the article, as both will reject the perfectly valid postmaster@ai address (check it out, "dig -t mx ai" will return a result, so that address must exist). The only thing you can be sure about in a non-local email address is that it contains at least one @ sign. More are allowed (for source routing), but hopefully no server is still configured to honor that, so you might get away with requiring exactly one @. Everything else is evil. Oh, and don't forget to make sure that one component in your spam^W email processing chain correctly encodes unicode charaters in the domain part into punycode.

Zev 16y ago

There are more reasons to check for an email than simply validation. Perhaps you want to detect emails in a field and let people click/tap on them to send that person an email? Don't want to let people send email off to foo@bar.baz now, do we?

richardw 16y ago

There are many other uses for this regex than registration systems. We have at least two situations where a staff member would type in a customer mail address, and some get it wrong. Confirming won't help, and getting it wrong costs lots of time to fix. Using a better regex costs very little.

Confusion 16y ago

If they get it wrong, intentionally or not, then they don't get their receipt, confirmation, validation link, etc. and I believe in most cases the incentive is there for them to get it right. Well, I hope you have a large enough support team, because with any reasonable amount of customer growth, you'll soon be swamped with support emails that say "I didn't get my ..., where is it? You suck!". Validating the email address (which includes checking for common typos in domains) is a service that reduces frustration and the amount of customer support needed.

ryan-allen 16y ago
Even if they've typed it correctly it still can be blocked for various reasons. You will still need a support mechanism (doesn't have to get all the way to a person) to sort out undelivered verification mails. It's just how it goes.
- sstrudeau 16y ago
  Still, some rudimentary validation can prevent cases of someone entering the wrong value (e.g., just their username) or an incomplete value (e.g., scott.trudeau@gmail ) -- which I see with some regularity ~10k signups/month. If this lowers support email volume by even just 10%, that's not insignificant.

Chilijoe 16y ago

You assume an email regex is only used for validating addresses. It can also be used to parse text for email addresses (for formatting or mining purposes maybe).