11 ms·

Could someone spell out a use case for this? One that comes to mind would be validating that a mailing list doesn't have any outdated email addresses in it, but

• tyingq 5y ago
  >but couldn't that be determined by just checking for a bounce when a message is sent to it The fewer times you bounce, the better your chances of not being marked as a spammer. This could also be useful for an ecommerce site, where you want to be able to easily contact the buyer if there's a delay, address correction needed, etc. People typo their own email at a rate that's surprising.
  • akcreek 5y ago
    I use email validation via MailGun for exactly this purpose with a productized service business. If we don't have a good email, then we can't deliver the service once complete. That leads to angry customers, even if the issue was a typo when they created the account. Easier to try and catch it during signup rather than at the time of delivery when emails start bouncing and you have no way to get ahold of the person.
    • tyingq 5y ago
      Mailcheck is also helpful to catch things like "user@gnail.com" and other common typos when the user types it in: https://github.com/mailcheck/mailcheck https://github.com/mailcheck/mailcheck Fork modified for React: https://github.com/eligolding/react-mailcheck#readme https://github.com/eligolding/react-mailcheck#readme
      • justinator 5y ago
        I somewhat lol'd when the demo allowed "user@gnail.com" just fine. Guess kickstarter isn't using mailcheck anymore. Looks like it's an open issue: https://github.com/mailcheck/mailcheck/issues/179 https://github.com/mailcheck/mailcheck/issues/179
        • tyingq 5y ago
          Oh, yeah, that's not good. Not sure why they didn't just repoint to the suggested https://codepen.io/ianneub/pen/BajKKBy https://codepen.io/ianneub/pen/BajKKBy demo.
• whakim 5y ago
  If you're asking for an email address in exchange for some piece of content (e.g. a soft paywall), I find that it's reasonably sensible to filter out the absolute spammiest-looking of email addresses in order to collect more real email addresses and prevent people just rolling their face across the keyboard and calling it a day. (It can also help with bots a little bit, although most bots are smart enough to use <random firstname>.<random lastname>@gmail.com or something). The best way to do this is obviously double opt-in, i.e. actually emailing the address in question. Most businesses believe (probably accurately; I don't have the stats) that this creates too much friction. I've used Sendgrid's email verification service in the past, and the actual scoring is basically garbage but if you set the threshold really low (e.g. reject all emails with a score between 0 and 0.1) then your precision is really good (almost every email address you reject is invalid, as measured by actually sending an email to them and the email hard-bouncing or being otherwise undeliverable). You let a decent number of bad emails through but it's an improvement over nothing.
• reid 5y ago
  I bought a new car a few years ago and I was unable to enter my .life email address into the SiriusXM registration form in the car. Had to use a .com address :(
  • blackearl 5y ago
    I specifically bought a cheap .org since some companies have trouble with lesser known TLDs
    • SilverRed 5y ago
      I have a .red and a .me and I have never not been able to sign up.
      • cratermoon 5y ago
        .life has four letters. Lots of terrible attempts to validate email addresses reject TLDs that aren't 2 or 3 characters.
        • gruez 5y ago
          >Lots of terrible attempts to validate email addresses reject TLDs that aren't 2 or 3 characters. which is sad because .info has been around for 20 years.
      • blackearl 5y ago
        pipesandcigars.com let me sign up with a .miami but now I can't login because it says it's invalid. My ISP frantically called me up after starting service because they took all my info down and then the system didn't like the domain. My utility company kept sending me requests to go paperless and I had to call them to get an answer on why that happened since I had accepted the paperless prompt, the issue was the domain. It's nice to have but I've had quite a few headaches with it
    • alibarber 5y ago
      I have a hyphen in the domain (.com) I use for personal email (it's shorter, just my initial and surname) and I still have had problems in some places with that - it's so frustrating.
• makeitdouble 5y ago
  I am not sure there is any clear legitimate use for deep validation (beyond checking for syntax). If you are providing a valuable service to a customer, wether it's a catch-all or free mail shouldn't matter to you. Now, if you are buying lists here and there to spam the hell out of it, the bounce rate would flag you very quick and you'd need to find another smtp provider every week. This service would be your life line.
• jlawer 5y ago
  The use case is marketing email. Sending to non-existent addresses can radically affect deliverability. If the address is to a large host, then they will use reaching invalid email addresses as evidence that you are not keeping to best practices. They will throttle deliverability, and possibly reject email. If your sending to an invalid host, then your mail sending provider (if your using one) may consider you a bad customer and send you through a lower grade of outbound IP addresses. Frequently new registrations are processed at once as batch imports from another system or from a partner. There is a need to remove these invalid email addresses pre-sending and hurting sending reputation.
  • smileysteve 5y ago
    Any engineer or product team that uses this lacks ethics and is putting their company at risk for CANSPAM. If you work at a company that would abuse hibp and a direct mention in CANSPAM you should refuse the work.
  • tlogan 5y ago
    This is not for “marketing emails”. This is for spammers.
    • bombcar 5y ago
      They’re the same thing, really.
      • tlogan 5y ago
        Not really: but majority of spammers think that they are doing marketing.
        • wyager 5y ago
          I've never once received a "marketing email" that wasn't spam.
          • 5y ago
• daniellarusso 5y ago
  We have been auditing legacy user accounts to begin a mapping to Zendesk, and Zendesk allows mapping to ‘organizations’ via email domain. For some of these legacy accounts, the registered email addresses may have typos. So, even a basic DNS check against the existence of the domain’s MX record is helpful. Any of the ‘suspect’ email addresses can then be further evaluated by a human, and then removed or fixed.
• spondyl 5y ago
  Personally, I do this kind of thing manually if I want to send some positive feedback to people who work at companies I like, but they don't have any obvious emails published. A recent example was the CEO of Evernote for the work put in to their behind the scenes series although I don't expect anyone to read it of course. People are busy! I wrote a bit about it here: https://utf9k.net/blog/email-lookup/ https://utf9k.net/blog/email-lookup/ Now does this scale? Not at all and I haven't read the email spec or anything like that. It's also handy in a pinch if you wrote down an email but can't remember if it's spelled correctly or not.
  • mattowen_uk 5y ago
    The non-interactive nslookup for Windows invocation: nslookup -query=mx evernote.com Edit: Trying out the macOS/Linux invocation on Windows also works: nslookup -q=mx evernote.com Oddly, the first time I did this, I only got IPv4 results, subsequent queries for the same domain, included IPv6 as well.
• maddyboo 5y ago
  I just watched a video where someone demo’d GitHub Copilot by writing a comment along the lines of // IsValidEmail takes a string and returns whether it’s a valid email address The AI response was a nightmarish 100+ character regex that made my blood curdle. I think of email validation like encryption: don’t roll your own, and don’t trust an AI to do it either. Edit: Here's the regex: https://gist.github.com/cassidoo/6101ef0657665683b787aab5ae9465f4#file-copilot-suggestions-js-L5-L9 https://gist.github.com/cassidoo/6101ef0657665683b787aab5ae9...
  • ToFab123 5y ago
    100+ is nothing. This is a regex that validates a string against the RFC822 "Standard for ARPA Internet Text Messages" and it contains 6424 characters. http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html
    • bombcar 5y ago
      This is a Tony the Pony situation almost.
  • cyberCleve 5y ago
    Does it work?
    • justinator 5y ago
      Yeah basically, but it doesn't validate an email address (user@example.com), it validates say, the From: header of a MIME message, which could contain an email address, a phrase (like a first and last name) comments, and all sorts of dumb dumb ideas like having phrases that have embedded comments and phrases that look like email addresses but aren't and on and on and on. This RFC is a trainwreck and whoever wrote it should feel bad about themselves.
  • slaymaker1907 5y ago
    This really seems like it is plagiarizing the regex from somewhere without citation.
• profmonocle 5y ago
  A non-marketing example: We were onboarding a large new client to our SAAS product. This process involved creating accounts for all of their employees (tens of thousands) and sending emails with an activation link. (Where they'd be able to set up their password.) Our system sends these emails in batches, and as soon as the first batch went out we got an alert from our monitoring system that our bounce rate was surging - high enough to risk a sending pause from Amazon SES. We stopped sending and investigated the issue, and it turned out that the email list we were given was a mess - it included all current employees, but also a huge number of former ones. Just under 1/10th of the emails in our first batch were invalid. We asked the client to give us a better list, but due to internal issues they couldn't get that to us any time soon. Meanwhile they were breathing down our necks to get these emails out ASAP, and they were a large enough client that our management wanted to keep them happy, so we tried out one of these email validation services. Unfortunately, it didn't work. It turns out that this technique doesn't work for all mail servers. It was reporting every email as valid, even ones we knew were invalid since they'd already hard bounced. (Edit: thinking back - this was several years ago - I think it wasn't saying that they were valid emails, just that it couldn't tell whether they were valid or not - the service was able to detect that the server wasn't rejecting non-existent addresses.) We ended up unpausing the emails and just hoping for the best. Ended up with something like an 8% bounce rate that eventually fell off our record as our normal sending patterns resumed. Amazon's guidelines say they might cut you off when you hit 10%, so we cut it pretty close.
  • donmcronald 5y ago
    It seems like the most practical solution to that should be calling AWS, explaining it for 5 min, and getting an exception. Is that kind of reasonable solution no longer possible with the cloud providers being so huge?
    • toomanybeersies 5y ago
      It's possible, you just need to pay the extra 10% for premium support.
  • kapp_in_life 5y ago
• vzaliva 5y ago
  I would love to clean up my addressbook removing no longer valid email addresses for contacts.
• irjustin 5y ago
  Ideally you don't want to send an email only to find out it doesn't exist, in terms of marketing. Do that too often and servers can start black listing your domain/IP because it looks like you're "scanning" for available email addresses.
• nemosaltat 5y ago
  Similar experiences here. I have [myfirstname]@[mylastname].party as my primary email. In meatspace it’s a curiosity, and people are sometimes incredulous. Online, I’m routinely given some variant of “enter a valid email address.”
• vatican_banker 5y ago
  Financial/fintech companies use services like these for fraud-detection on account opening. While validating an email is by no means and exhaustive and conclusive signal to classify a fraud/genuine user, verifying the validity of new customers's email addresses is a big help.
• tdeck 5y ago
  I maintain a small fee tool for creating API endpoints to trigger email alerts for yourself (varmail.me). Since it's very basic and has no marketing, it doesn't get too many users. You have to click a link in an email to even log in, but I still get bots stuffing my login form with known bad email addresses (I've googled and some of them appear in honeypot lists). There is no chance they can get in, but this is bad because my login verification emails look like spam, since a large percentage of them are sent in response to these bots. So I definitely see some value in a way to pre-screen the emails there.
  • pnutjam 5y ago
    Interesting project, maybe you need a captcha to display and weed out bots before you actually send an email.
    • tdeck 5y ago
      Yes, I've considered it. The thing is I really dislike captchas so I tried to avoid deploying one. I do have a hidden form field that gets populated with a secret value in JavaScript, so the bots must be running JS at least to function.
• miyuru 5y ago
  For email confirmation. The practice of email confirmation is still widely used, but the change in email deliverable rules has make it a pain to properly validate them. Even if you are using a 3rd party provider like SES or mailgun, they have a email bounce limit. A considerable number of real world users give fake email address(which is even sometimes encouraged on HN) which triggers those bounce limits. To fix it, there are paid services but they does not work very well. Fixing it yourself take a lot of engineering time, that is better spent elsewhere. Providing an open solution to this problem (which is given in the github repo) is a double edge sword. As this gives a edge to spammers who created the problem in the first place.
• yread 5y ago
  If you use Amazon SES and have a high bounce rate they will just block you. So, Eve could flood your registration with invalid emails that would cause bounces, that would stop all your emails from getting delivered. A DoS you can only recover from by switching to a different email provider
• jader201 5y ago
  > Please hire me, SiriusXM. Given their questionable business practices, their customer service dark patterns, their dated and awful UX, and their inevitable demise to much more popular streaming services, you’d be best to stay far away.
• groundthrower 5y ago
  I sometimes use it for sales. Looking up a company on LinkedIn, then finding the name of a person I want to each our to but am not sure about the email. Then I could try the classic first name.last name @ domain to see if it’s worth sending an email
• cookie_monsta 5y ago
  > Please hire me, SiriusXM. Honestly not where I thought that rant was heading ;)
• celticninja 5y ago
  The service I work on emails users(B) after their email address has been input by another user(A) of our service. This would allow us to check that the email is reachable before we attempt to send the email. If it is not we can ask user(A) to check before they proceed.
• relix 5y ago
  I receive a lot of fake user signups on the web tool I publish for free. These users (bots?) sign up using fake email addresses, but putting a captcha does not help much. I send a confirmation email to these users to make sure they exist, but if the email address does not exist, sending that confirmation email hits my account's deliverability (spam) score as it generates a bounce which my email sender provider does not appreciate. For example, I've received multiple warnings from Intercom that I need to improve deliverability of my email, or they will ban my account. Ironically one of the suggestions is to use confirmation emails - but that's exactly where the problem is for me. A tool like this helps me to weed out a ton of these undeliverable email addresses to avoid sending emails that will hit my spam score. > checking for a bounce So in my case, generating that bounce is exactly what I need to avoid in order to make sure my account remains in good standing.
  • r1ch 5y ago
    If a tool like this works for you, what stops you from sending validation emails yourself?
    • cj 5y ago
      I'm not the OP, but the answer is typically 1) Time, and.. 2) Deliverability Home grown email systems require monitoring (e.g. deliverability rates, IP reputation monitoring) and maintenance of the system itself which can be a time sink. The reality is without using SES, Sendgrid, or a similar 3rd party provider, avoiding people's spam folder is very tricky.
  • ericmay 5y ago
    I think what this is telling you is that users don’t value giving you their email address for your free tools. They know why you want their email address, and they don’t want that, but they do want your tools. Maybe it’s time to charge money for those tools or change models? Maybe not give access until the email address is confirmed? Worth considering I guess. Idk the details. I do this all the time. Ads and malpractice have made giving out your email address risky business. If a user can give you a fake email and get what they want without giving you anything (subject to your ads or whatever you’re using their email for) that’s the logical thing for them to do. Not judging or anything though I know my tone might seem that way.
• tealpod 5y ago
  I use to have a active product DearEle.com an email reminder service. There was a feature to cc everyone in email, which is used by spammers to send junk products to everyone. The source emails were all fake. Email check prevent fake emails.
• snowwrestler 5y ago
  Any kind of technical email validation is horribly unreliable at best and there is no chance that this GitHub repo is going to work any better. As a result the only place such a service is useful is for someone who has a ton of low-value emails they don’t trust, and they don’t want a ton of bounces when they hit send (which risks losing your send privileges with pretty much high-volume email platform). So they run all their emails through a service like this, and only send to the ones marked valid. This excludes a ton of emails that actually are valid, but failed the check (false negatives). But that’s ok because the emails were low-value to begin with. If this sounds like a spammy operation… bingo. Technical email validation services are really only useful for people who are doing things like buying email lists from commercial providers, harvesting emails from sites like HN, or forcing people to enter an email address to do basic things with a free service.
• iancmceachern 5y ago
  Marketing?
• TYPE_FASTER 5y ago
  I’m tempted to add a spam detector rule that runs all From addresses through this.
• deviledeggs 5y ago
  It has honeypot detection. It's built for spamming people. There's literally zero reason to avoid honeypots otherwise