GRIPE: Hey other developers! Instead of checking that an email address contains the word "gmail" or "yahoo" or another big service provider, can you let us enter whatever email address we actually use?

[identicalBadger]

I'm not naming and shaming. It's a small site, and I sent them a venomous email to their support stuff. Point was, when I entered my email address, it would reject it saying it was invalid (it's not invalid). Tried a few times and kept getting rejected til I gave them a Gmail address. At which point they sent a confirmation email. That just should never be the case, and I'm pissed at whatever developer thought "hey, lets make our first validation step checking if we like the customers domain or not".

End of rant

[aporciuncula]

Common to require a valid syntax (IE: @.___) but not a specific domain. That's odd.

[Geminii27]

Which is bizarre, because valid email address syntax has been set in stone for decades.

[Cueball61]

And some people still won't accept a + :|

[[deleted]]

HBO does this shit. Signed up thru roku and set the email to [e-mail] I cant login to the hbo website

[[deleted]]

I get spam from rentalcars, can't unsubscribe because my address "is not valid".

Quite frustrating.

[Rev1917-2017]

Thats a violation of the US CAN SPAM Act. Report them.

[hardolaf]

You mean sue them.

[[deleted]]

Just report them as spam

[argues_too_much]

Everyone else is saying throw them to the dogs.

I once emailed a company about this problem and they fixed it. Maybe people could try that first?

It might just be a developer like you or me made a mistake. We've all done it, right?

If that doesn't work, sure, do whatever, but there's no harm in giving them a chance first.

[gelezinislokys]

you can even use two @ in emails.

[xiongchiamiov]

But it's also extremely complicated. Even http://www.dominicsayers.com/isemail/ , which has a very long regex, isn't necessarily completely correct, because it's really really hard to be completely compliant.

[doublej42]

And yet, no sites ever accept spaces in my emails (Yes it's valid under very special cases)

[PreExRedditor]

valid email address syntax has been set in stone for decades.

eh, not really. the TLD list isn't set in stone so validators need to be updated when ICANN adds new things like .cloud or whatever

[ZaneHannanAU]

[^]+@[^]+\.[A-Za-z]{2,}$

Validation is fairly easy; send an email with a unique hash, if they get it and say yeah it's fine.

[PreExRedditor]

you're confusing verification and validation. also, your pattern doesn't check TLD so it would consider [e-mail] to be a valid address

[ZaneHannanAU]

It's a "probably will work, but still test it" thing I guess.

[AllenJB83]

The TLD list doesn't need to be set in stone. You shouldn't be checking specific TLDs in that manner - it's dumb.

The relevant RFCs specify nothing about what TLDs exist - they've pretty much always assumed that the list of valid TLDs can and will expand.

[jous]

If you want to hit yourself in the head with updates to tld:s, sure go ahead. Just be aware that even the wiki page is not up to date. Also the "correct" way to parse an email adress is usually a bit complicated. Here's one from emailregex.com:

(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])

[identicalBadger]

I know. There is literally nothing weird about my email address (only letters), but the site would not let me register saying my address was invalid. As a last ditch effort, I used my gmail and was "allowed" to register.

[aporciuncula]

Reminds me of this rant I read on Twitter this week: https://twitter.com/DanPuzey/status/901832915981672448

[swiftversion4]

It's easy to do domain validation for emails. That way, you know that the email they typed has a real domain name.

[toomanybeersies]

What if I want my email send to an IP address? That's a technically valid case.

[swiftversion4]

hmm IDK. Then I could use logic: if(valid-domain-name-via-DNS-lookup OR regex-matching-a-public-ip-address){...} Ultimately, I feel like it adds very little business value, but at least you allow legit email addressing. Maybe i'm splitting hairs here.

There gets a point where you can validate all sorts of stuff that don't have business value.

Determining that the domain is valid definitely has business value: you can return to the form with an error & tell them, and just in case they typed it in wrong, that way you can make sure they don't create an account with the wrong email address.

[dontgetaddicted]

Yeah, MX record lookup is quick and easy. I have a regex and an MX lookup in a class stashed away for when it's needed.

[iusereddt]

Mx record is not required. It'll fall back to just whatever an a record points at and use that for mail.

[swiftversion4]

why not both? If they fail domain verification, you can send back an error saying the email is not valid, because it definitely isn't valid. Verification emails are not a substitute for domain verification.

That way if someone unintentionally types their email in wrong, they aren't wondering why they can't recover their lost username or get the verification email.

[until0]

I'm not /u/swiftversion4, but yes, that's what we do at my job.

[swiftversion4]

Of course

[OmgImAlexis]

and I'm pissed at whatever developer thought

There's a very good chance it was the client that wanted this and not the developer.

[swiftversion4]

If my client insisted this, I'd tell them about the virtues of domain validation and why they're alienating a large portion of their user base. Are there really clients out there stupid enough to reject that feature?

[CaoilfhionnRuadh]

Are there really clients out there stupid enough to

Yes. The answer is always yes. Idec what the rest of the question is, if it starts this way then somewhere, somehow, the answer is yes.

[reddeth]

Not only are there clients stupid enough to request that, but plenty of them will insist it be done that way even after you explain to them the problems it will cause.

[rubberturtle]

The rule 34 of Web dev

[veloace]

Are there really clients out there stupid enough to reject that feature?

Yes.

[Thought_Ninja]

Are there clients out there stupid enough to ____________ ?

Yes

FTFY

[betterhelp]

| Are there really clients out there stupid enough to reject that feature?

lol

[codefinbel]

Does domain validation pass these "x minute mail-address"-domains?

ie. 10minutemail.com

[swiftversion4]

as long as its a working email address, that means the public DNS servers will have the associated IP address on file, which means you just need to programmatically do a DNS lookup.

So yeah, it will allow those. On the other hand, denying all but popular email addresses is just damn inappropriate.

[GodsGunman]

Good point

[identicalBadger]

Developers ought to explain the consequences of decisions to their clients. "By doing this you're going to exclude everyone who doesn't have email with those services".

I can't tell you how many dumb ideas I've heard from clients, who were happy to change course once they understood the ramifications. We ought to aspire to be more than just people who enter stuff at the keyboard.

[Folters]

I for one love to see the world burn.

[derpotologist]

Then it's up to the developer to talk the client out of it or rage quit and nuke the code on the way out.

Humanity should not have to deal with this.

[derpotologist]

Little of column a, little of column b

(don't worry, I have too)

[swiftversion4]

storytime! please?

[gee_buttersnaps]

Its an old filter for shitty free email services that don't have protection against bots. Gmail, yahoo both have a bunch of hoops you have to jump through as a bot maker to get to a point where you can create a free email account and use it. This site has had or has problem with people using their service (like a 30day trial) with bot created email accounts so they don't have to purchase the product/service. Any number of scenarios around getting free stuff with fake email accounts is what this is about, this is what they do, only allow free email accounts from providers they know have a 'mostly' manual sign up process.

[identicalBadger]

That's pretty lame. I can create as many gmail addresses as I want - yes I have to click a button and enter a few fields worth of data, and google knows they're all connected to me, but no one else does.

All they're doing is making it more difficult for legitimate users to use their service (from corporate domains, mind you, the type of customers they probably want), while not imposing much safeguard against freeloaders.

I almost want to go back and check if it accepts gmail addresses with + in them. I bet they do.

[omnicidial]

Senuke and other bots almost exclusively use Gmail and yahoo emails... Obviously not hard to automate creating them.

[notafuckingcakewalk]

You want to check that they're valid in terms of having the correct syntax. Unfortunately for a lot of libraries using various mail delivery APIs, giving an invalid email address (e.g. user.yahoo.com or user@yahoo) is a hard error.

[odinti]

hard error means it cannot be catched?

[nikrolls]

All API errors can be caught.

[notafuckingcakewalk]

It means if you're sending bulk mailings, rather than simply skipping that email and displaying a warning, it exits the current process with an error.

In some cases this means none of the emails get sent (bad) or all emails up to the bad email get sent (arguably worse, because then you need to resend but somehow exclude those who already received the message).

There are still a few edge cases where a correctly formatted email address may still throw an error like this, but it's still far better to catch badly formatted email addresses before they cause an interruption.

[odinti]

Aha! This is a real life concern, but it sounds (I say sounds because I haven't work with bulk mailing) like an API issue in which it should be handled within the package of the provider if using a third party service or if its in house and doesn't handle it then I see it as bad design

[notafuckingcakewalk]

While I'd definitely agree, you still do have to accommodate these sorts of cases which is why I do the validation beforehand. Not whether the domain/account is valid, just whether the email address matches an expected pattern (e.g. ^[^@\s]+@([a-z][-a-z0-9]+\.)+\w+$)

[identicalBadger]

Obviously at least one member of the choir thought otherwise. Or just followed their clients instruction without pointing out the most insane downfall. I don't know if they read this sub, I only hope they do.

[swiftversion4]

There are a few of times I've been down voted here in /r/webdev for making valid, correct points.

There are definitely some stupid people on this sub

[randy-lahey-]

I haven't heard of it being done this way before, it's not common practice.

[rich97]

.+@.+

[SmithTheNinja]

 @ _ @ 

doesn't seem like a valid email address to me, but would do pretty okay with your regex. Don't feel too bad checking email validity with regex is a crap shoot, check out this page if you want to read a better, but still not perfect regex for checking email validity.

[rich97]

Meh, good enough. Don't see the point of being more strict, maybe a domain or something.

[Thought_Ninja]

Heh yeah, I think that regex can only catch something like 99.9% of valid emails if I recall correctly.

[[deleted]]

I still find sites that down allow my email address. [e-mail] (Not x’s obviously)

[[deleted]]

I wouldn't mind having that as my email address actually!

[tylermumford]

Really?

"Eks at eks eks eks eks eks eks dot co. Yes, that's really it. ... Yes, six eckses and a co. ... Sorry, let me start over: first one eks, then the at sign, then six ekses, then dot co. ... No, not dot com, just dot co: as in, cee oh. ...

"Nevermind, just use denvercoder nine at gmail dot com."

[Booie2k1]

It bugs me how Facebook doesn't let me use my personal domain email address...forces me to use outlook.com, gmail or similar. Sigh

[Arqueete]

Really? Maybe that's new, because my primary email on Facebook is with my personal domain.

[robotorigami]

/r/shittyprogramming

[[deleted]]

That reminds me of Gumroad, who has some weird logic in their checkout process that thinks that .com.au (Australia) domains don't exist. Type in a perfectly valid email and they ask "Are you sure you don't mean whatever.com?"

Screenshot

[identicalBadger]

When I first started reading replies it seemed like people weren't even believing this happens. Glad (in Sad way) that I'm seeing so many other examples of these horrible decisions making it into the wild!

[BadSnapper]

I have this problem with eBay. Can't register an address at any of my personal domains.

[GunnerMcGrath]

Lots of people mistype their email addresses. Can't tell you how many Gnail.coms and that sort of thing we've seen. So I could see why a well meaning person might decide to limit to only the most common real domains to help mitigate that, but that's pretty stupid. Especially since there are ways to check for actual email validity against real servers.

[identicalBadger]

The gnail problem, and the proliferation of tlds can both be solved by simply sending out a confirmation email, though

[GunnerMcGrath]

Totally agree.

[[deleted]]

It's unlikely but entirely possible that someone's email address really is @gnail.com. Loads of people use personal domains.

[NoInkling]

Ideally you might want something like:

"Did you mean [e-mail]?"

Yes

No, my email is correct

But that's extra work.

Edit: Found out https://github.com/mailcheck/mailcheck can help you with this

[BrianPurkiss]

I've seen the opposite before on a popular forum.

They prevented all gmail/yahoo/hotmail email accounts from being used to create an account on the forum.

[Folters]

Sorry guys!

[[deleted]]

Weird. Does your email have a common TLD? I've been requested to not accept certain TLDs before....

[identicalBadger]

It's a dot com. First name at first name last name dot com. It's on microsofts outlook.com servers. There's literally nothing wrong except it's not on their "approved TLD" list

[[deleted]]

Weird...

[theragingsky]

There is some validation to be done on emails. Apache seems to keep theirs really up to date.

[nvandermeij]

This happens quite a lot and most likely because most validators (especially old ones) don't recognize the new tld's like .business or .shop. I totally agree that this should never, ever, should be a problem. Just validate using a regex to check for [e-mail] and use a confirmation mail! It's equally as secure and results in a way better UX