JoshData / python-email-validator

A robust email syntax and deliverability validation library for Python.
The Unlicense
1.11k stars 113 forks source link

Deliverability Validator will validate Domain, but not Subdomain #134

Closed Datamine closed 5 months ago

Datamine commented 5 months ago

I've observed a number of undeliverable emails passing email_validator(email, check_deliverability=True), such as foo@g.mail.com.

If you look up mail.com, it has valid MX records. But g.mail.com doesn't. That should return as undeliverable, shouldn't it?

JoshData commented 5 months ago

No, that's not correct.

RFC 5321 (SMTP) section 5.1 says:

If an empty list of MXs is returned, the address is treated as if it was associated with an implicit MX RR, with a preference of 0, pointing to that host.

In other words, an MX record is optional if its mail should be directed to itself.

In that case, this library checks that the domain name has either an A or AAAA (IPv6) record.

For that domain, it has an AAAA record:

$ dig aaaa g.mail.com

...;; ANSWER SECTION:
g.mail.com.     7161    IN  AAAA    ::1

The address is not meaningful, it's the loopback address, but this library doesn't check that. Maybe it should. (I'd accept a PR that checks that the returned IP address is a public address.) I've never seen this situation before though.

If you run this library on the address it will give you a clue about it in mx_fallback_type:

$ python -m email_validator "test@g.mail.com"
{
  "ascii_domain": "g.mail.com",
  "ascii_email": "test@g.mail.com",
  "ascii_local_part": "test",
  "display_name": null,
  "domain": "g.mail.com",
  "local_part": "test",
  "mx": [
    [
      0,
      "::1"
    ]
  ],
  "mx_fallback_type": "AAAA",
  "normalized": "test@g.mail.com",
  "original": "test@g.mail.com",
  "smtputf8": false
}