Mister Dookie <misterdookie@gmail.com> said (on 2006/10/24):
Is there a way to verify that an e-mail address
(e.g."johnsmith@company.com") is valid and exists or does not exist
(is a fake e-mail address) without actually sending a message to that
address and awaiting the response?
It's a pretty safe bet that any modern email addresses will have an @
sign, and at least a single '.' in the domain part. A valid email domain
must have an MX record or an A record (in DNS).
Very little filtering can be done with the username part of the email. (I
am particularly annoyed by the proliferation of web forms that refuse to
accept +, :, and . as a valid characters in email usernames.) To validate
the username, you have to talk to the destination mail server. If that's
not possible, you'll have to settle for unvalidated emails.
You can get "pretty good" assurance of valid email by just talking to
the destination mail server. Remember SMTP goes something like:
220 mail.example.com Some banner message
HELO myhost.example.com
250 myhost.example.com Nice to meet you
MAIL FROM:<>
250 2.1.0 Proceed
RCPT TO:<testuser@example.com>
If at this point the mail server returns 250 2.1.5 (or anything besides
4xx or 5xx really) you have gotten as much assurance as reasonably
possible that the email address is valid. If you get a 550 5.1.1 message
the email is invalid. Once you get your answer, you can just QUIT and no
email is ever sent.
This method is imperfect. Some mail servers refuse to accept MAIL
FROM:<> (even though it's in the RFC). Some domain's name server may
be nonresponsive (like dude.com appears to be :). The server may have
greylisting in effect -- in which case you'll get a 4xx temporary failure
error code that doesn't say whether the user is valid or not. Some mail
servers return 250 no matter whether the user is valid or not. The only
way to be sure is to send them an email and make them prove they received
it -- which you said, is not possible in this situation.
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
