What methods can be used to validate email accounts at the code level?

Summary

Email validation at the code level involves a multifaceted approach, with the consensus being that no single method is foolproof. Confirmed opt-in consistently emerges as the most reliable technique. Basic validation often starts with regular expressions to check syntax, though this method has limitations. More advanced techniques include DNS lookups for MX records, and employing dedicated libraries (e.g., Python's email-validator). External validation services offer comprehensive checks, but they can be costly. Considerations also include managing budget constraints, the potential for losing valid addresses, avoiding unreliable SMTP validation, preventing email injection vulnerabilities, and maintaining overall email list hygiene.

Key findings

  • Confirmed Opt-In: Confirmed opt-in is the most effective email validation method.
  • Regex Inadequacy: Regular expressions alone are insufficient for complete email validation.
  • Third-Party Benefit: Third-party validation services offer comprehensive checks but cost money.
  • Importance of DNS: DNS lookups for MX records can verify domain existence.
  • Library Benefit: Libraries provide validation through domain name validation, address parsing and DNS queries.
  • All methods are imperfect: Remember that all email validation methods are imperfect.

Key considerations

  • Budget Constraints: Budget constraints limit use of paid validation.
  • Avoid Data Loss: Aggressive validation may lose valid addresses.
  • SMTP Unreliability: SMTP validation should be avoided as it is unreliable.
  • Security Required: Security should be prioritised to prevent injection vulnerabilites
  • Email Hygiene: Email hygiene is important for deliverability

What email marketers say
16Marketer opinions

Validating email addresses at the code level involves various methods, ranging from simple syntax checks using regular expressions to more complex techniques like DNS lookups and third-party validation services. Confirmed opt-in is consistently recommended as the most reliable approach. Other suggestions include reconfirmation campaigns, identifying patterns in suspicious emails, and leveraging email performance data to weed out inactive addresses. External validation services offer comprehensive checks but come at a cost. It's also crucial to consider factors like budget constraints and potential data loss when choosing a validation method.

Key opinions

  • Confirmed Opt-In: Confirmed opt-in remains the gold standard for ensuring valid email addresses.
  • Regular Expressions: Regular expressions can catch basic syntax errors, but are insufficient for complete validation.
  • Third-Party Services: Third-party validation services offer comprehensive checks but may be costly.
  • DNS Lookups: DNS lookups for MX records can verify the existence of the email domain.
  • Email Performance: Email performance metrics (e.g., opens, clicks) can indicate whether an address is active and valid.
  • Bulk Validation: Bulk email validation can provide specific info on errors and deliverability.

Key considerations

  • Budget: Budget constraints may limit the use of paid validation services.
  • Data Loss: Aggressive validation methods may result in the loss of valid email addresses.
  • SMTP Validation Limitations: Avoid SMTP validation due to rate limits and greylisting causing it to be unreliable.
  • Regex Limitations: Regex is limited as the sole validator
Marketer view

Marketer from Email Geeks mentions you could also pay a third-party validation service, whilst it will catch a lot of typos, they are no substitution for confirming the address when you get it.

April 2022 - Email Geeks
Marketer view

Marketer from Email Geeks shares that if you're on a budget and really don't mind loosing some valid addresses, you could remove any address with numbers or more than one full stop/period.

March 2023 - Email Geeks
Marketer view

Email marketer from GitHub answers a question about email validation by introducing the is_email() function, a PHP email validator. The validator checks syntax, DNS records, and performs some level of spoof checking. It provides different levels of validation and can be customized for specific requirements.

May 2022 - GitHub
Marketer view

Email marketer from Reddit warns against SMTP validation (HELO/MAIL FROM/RCPT TO) due to rate limiting and greylisting. Modern mail servers often block or delay connections from unknown sources to prevent spam, making this method unreliable.

January 2022 - Reddit
Marketer view

Email marketer from Reddit suggests using an external email verification service, like ZeroBounce or NeverBounce, for best results. These services check the syntax, domain, and mailbox existence, resulting in more accurate validation.

September 2023 - Reddit
Marketer view

Marketer from Email Geeks explains that regex will not cover all cases of validating email addresses. Some regexes exist for cleaning up .con vs .com, hotmal vs hotmail etc. There’s APIs you can use of course to bulk validate a suspicious list too.

July 2024 - Email Geeks
Marketer view

Marketer from Email Geeks says that validating syntax won't do anything for you, as those are valid addresses. There are scripts that will make a connection to the MX but abort the connection after RCPT TO, the idea being that if RCPT TO doesn't error that the address exists. But then ESPs have implemented things to prevent this kind of address scraping. The best thing to do is just send an opt-in.

November 2023 - Email Geeks
Marketer view

Marketer from Email Geeks suggests finding patterns such as you have above and using a combination of regexes. Maybe you could look at people who have email addresses that are very similar to others in your database? If you see five like the above, almost certainly spammy. So it might be the relationship between emails in the database rather than a regex.

June 2021 - Email Geeks
Marketer view

Marketer from Email Geeks suggests putting the removed emails into a reconfirmation campaign and slowly sending to them.

March 2022 - Email Geeks
Marketer view

Email marketer from Stack Overflow shares that, in addition to validating syntax, check for common disposable email domains. Also check if the domain has a valid MX record, as well as looking out for common typo domains like gnail.com

January 2023 - Stack Overflow
Marketer view

Marketer from Email Geeks suggests matching on 5 or more full stops to clean up suspicious emails. Check that against known good emails though.

November 2023 - Email Geeks
Marketer view

Marketer from Email Geeks shares that Confirmed Opt-In is the best way to keep a list free of bogus or mistyped addresses.

October 2022 - Email Geeks
Marketer view

Marketer from Email Geeks suggests that if you have any data about the performance of these recipients, that’s probably a far better indicator of being valid or not. No opens in 12 months? Ditch.

April 2024 - Email Geeks
Marketer view

Email marketer from Stack Overflow shares using `filter_var($email, FILTER_VALIDATE_EMAIL)` as the standard method, noting that full compliance with RFC 822 is impractical. Also explains that MX record lookup is a good secondary validation step, but explains a full SMTP VRFY is unreliable.

August 2022 - Stack Overflow
Marketer view

Email marketer from Stack Overflow explains that you should filter the input with FILTER_VALIDATE_EMAIL. Then perform a DNS lookup for the domain's MX record. Finally, attempt to open a socket to the mail server. This confirms both the format and existence of the domain.

May 2023 - Stack Overflow
Marketer view

Email marketer from Email Hippo explains that using a bulk email validation tool is highly recommended. The tool will provide information on bad domains, syntax errors, disposable emails, greylisting errors and deliverability.

September 2023 - Email Hippo

What the experts say
2Expert opinions

Email validation is crucial for maintaining good email hygiene and deliverability, but all validation methods are imperfect. Confirmed opt-in is the most reliable approach. For high bounce rates, consider using a list cleaning service. Methods like syntax checking, domain verification, and SMTP handshakes can be used, but their limitations should be acknowledged.

Key opinions

  • Imperfect Validators: All email validation methods have limitations.
  • Confirmed Opt-in: Confirmed opt-in is the most reliable validation method.
  • List Cleaning Services: List cleaning services are beneficial for high bounce rates.

Key considerations

  • Method Limitations: Acknowledge the limitations of syntax checking, domain verification, and SMTP handshakes.
  • Email Hygiene: Good email hygiene is essential for deliverability.
Expert view

Expert from Word to the Wise explains maintaining good email hygiene by removing invalid email addresses from your contact list is essential for deliverability. Suggests methods like syntax checking, domain verification, and SMTP handshakes, but notes these are imperfect and confirmed opt-in is superior.

February 2024 - Word to the Wise
Expert view

Expert from Spam Resource responds with the reminder that all email validators are imperfect. Sending a confirmation email and requesting the recipient to click on a link is the most reliable way to validate an email address. If bounces are high, use a list cleaning service that performs mailbox validation.

September 2023 - Spam Resource

What the documentation says
5Technical articles

Email validation at the code level involves various techniques as detailed in technical documentation. Regular expressions are commonly used to check the syntax, ensuring a valid prefix, @ symbol, and domain. Input validation, especially using allow lists and escaping special characters, is crucial for preventing email injection attacks. Understanding the formal email address syntax defined in RFC 5322 is essential. Libraries like the email-validator in Python offer comprehensive validation by incorporating domain name validation, address parsing, and DNS queries. Different languages, like Javascript, also have validation techniques available including regex.

Key findings

  • Regex Validation: Regular expressions are used for basic email syntax validation.
  • Input Validation: Proper input validation prevents email injection attacks.
  • RFC 5322: RFC 5322 defines the formal syntax for email addresses.
  • Library Validation: Libraries such as email-validator in Python provide comprehensive validation.
  • Language Validation: Different languages have validation methods like using Regex in javascript

Key considerations

  • Regex Limitations: Regex-based validation has limitations and requires additional checks.
  • Security: Email validation must prioritize security to prevent injection vulnerabilities.
Technical article

Documentation from RFC Editor outlines the formal syntax for email addresses. It details the allowed characters, structure of the local part and domain, and the use of comments and folding whitespace. It's important for understanding the technical specifications behind email address validation.

October 2021 - RFC Editor
Technical article

Documentation from Python Docs answers a question about Email Address Verification by introducing the email-validator library, which incorporates domain name validation, address parsing, and DNS queries to confirm the structure and legitimacy of an email address.

September 2021 - Python Docs
Technical article

Documentation from Microsoft Docs explains how to validate an email address using regular expressions in C#. The example code uses the `Regex` class to match the email address against a pattern. It checks for a valid prefix, @ symbol, and domain. Also discusses limitations of regex-based validation, recommending additional checks.

March 2022 - Microsoft Docs
Technical article

Documentation from Freshworks describes the steps involved in Javascript validation - including using Regex to validate email addresses. It also includes using try and catch to validate the email address.

June 2023 - Freshworks
Technical article

Documentation from OWASP explains that proper input validation is crucial to prevent email injection attacks. It recommends using allow lists of permitted characters and escaping any special characters. Also suggests using a dedicated email sending library that handles proper encoding and prevents injection vulnerabilities.

August 2023 - OWASP