4 ms·
This is just awful. A quick scan of the code brings up the following problems: * It fails to deal with the case where there is no MX record for the domain (fal
by baudehlo 14y ago
This is just awful. A quick scan of the code brings up the following problems:
* It fails to deal with the case where there is no MX record for the domain (fall back to A record)
* It fails to sort the MX records, potentially falling foul to tarpits
* It fails to connect to each A record lookup of the MX host on failures
* It fails to deal with transient failures (such as 4xx responses)
That was just from a quick scan.
Connecting to MX servers in a web environment (especially one using blocking I/O like Django) is generally a really bad idea. Many MX servers use delays and slow responses to combat spammers, and you're passing those slow responses on to your users.
Just check it looks vaguely like an email (the regexp fein posted is good enough most of the time) and send a confirmation email - it's the right thing to do.
- andrewaylett 14y agoFailing to deal with transient failures is especially bad when trying to deliver to a system that uses greylisting.
- deleted 14y ago[deleted]
- greyboy 14y agoAdditionally, doesn't it rely on the truthfulness of the SMTP server? That's not a good assumption - it's common to accept anything and null-routes bad addresses.
- baudehlo 14y agoIndeed it does - the only way to truly validate is to get that confirmation email through. On the flip side I do think there's some value in a service which provides a check on the domain - that way you can prevent someone typing in username@gmail.con by accident. But you'd have to actually implement it correctly. Would people be interested in something like this as service?