Everybody knows that if you try to register to a website with an email that does not exist, the website labels the email as "invalid". How do they know that?
5
-
1$\begingroup$ I've successfully registered for sites with non-existent emails. Do you have a specific example of a site that thwarts this? $\endgroup$– DMGregoryOct 24, 2021 at 0:55
-
$\begingroup$ For example, Twitter. I wrote a purely random email and it said "please enter a valid email". $\endgroup$– user144536Oct 24, 2021 at 1:31
-
$\begingroup$ I just entered a fake email address and it was accepted. Can you give an example of the fake you used? Was it in a valid format (something like ab1cd@xyz.com)? $\endgroup$– DMGregoryOct 24, 2021 at 1:34
-
3$\begingroup$ Questions about how a particular piece of software or hardware works aren't science. $\endgroup$– greybeardOct 24, 2021 at 9:35
-
$\begingroup$ @DMGregory On the other hand, I've frequently encountered the situation in which a valid email address does not get recognized as such. Matching email addresses with regular expressions is not as easy as it seems. $\endgroup$– StevenNov 16, 2021 at 22:43
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
A common strategy is to not bother checking if the email address is valid. Instead, you just send an email to the address with a link that finishes the registration. If the address is wrong, you won’t be able to tap the link and finish registration.
In the email you include some very clear wording that this email was received because someone tried to register at your site, and if the recipient didn’t do that, then they should not tap the link.
You might include a code on your registration site that needs to be entered when the confirmation link is tapped, so the receiver at an incorrect email address is not able to finish the registration.
So on the registration page: “Please enter your email address. A confirmation link will be sent to your email, please enter abcd in the confirmation site”
The link sent contains an id identifying the new member, and will finalise the registration if the user enters abcd.
This will only work if the email address is the one of the person registering.
$\begingroup$
$\endgroup$
While the question of how Twitter specifically works is not relevant to this site, there is a real scientific question lurking here: how might software be able to tell if an email is real or not?
It is impossible to tell in general. But in practice people would use two partial methods:
First, using pattern matching. Often an email is not legit if it does not have exactly one
@sign, or if it contains any invalid Unicode characters. Beyond this there is no way to give any more specific check without rejecting certain valid emails.Second, if you have access to a database of some kind listing all valid emails. This only works if you are one of the major email providers (e.g. Google), or if you have your users log in to your site through Google's API. In these cases, Google can directly check your email against the database to see if it is valid.
answered Nov 15, 2021 at 21:18