nette / utils

🛠 Lightweight utilities for string & array manipulation, image handling, safe JSON encoding/decoding, validation, slug or strong password generating etc.
https://doc.nette.org/utils
Other
1.98k stars 147 forks source link

Validators::isEmail: Add check for DNS nameservers. #269

Open janbarasek opened 3 years ago

janbarasek commented 3 years ago

E-mail should be valid only in case of domain name use valid MX DNS record.

Examples:

Validators::isEmail('jan@barasek.com'); // true
Validators::isEmail('jan@aaadfergrtgeaaa.com'); // true
Validators::isEmail('jan@aaadfergrtgeaaa.com', true); // false
milo commented 3 years ago

You don't need MX record. A, or AAAA is sufficient to deliver e-mails.

mabar commented 3 years ago

Also I think checkdnsrr(idn_to_ascii($domain), 'MX')) should be used. checkdnsrr() returns bool and idn_to_ascii() is for domains like ñandu.cl (var_dump(checkdnsrr(idn_to_ascii('ñandu.cl'), 'MX'));)

Ideal would imho be to support only fully FQDN - if trailing dot is missing, add it. It should prevent multiple lookups with relative domain name. So instead of google.com, always look for google.com.

milo commented 3 years ago

Part after @ can be domain (MX is required), or hostname (one of MX, A, or AAAA is required). I think checking existence of MX or A or AAAA by checkdnsrr() is sufficient.

To IDN - yes, idn_to_ascii() shoud be used, but I'm not sure, default parameters are OK.

dg commented 2 years ago

@janbarasek can you update PR please?

nechutny commented 2 years ago

There was forum post about this 8 years ago https://forum.nette.org/en/1293-mail-adress-validation-mx-records and it contains good points which needs to be solved.

milo commented 2 years ago

I don't think so

We only want to check that domain/hostname exists, not that they has correctly configured mail delivery. If domain/hostname is wrong, MTA fails immediately (that's what we want to prevent). If domain/hostname is correct, but MX records are incorrect or host is down, MTA will use queue and will try to deliver later.

mabar commented 2 years ago

You don't need MX record. A, or AAAA is sufficient to deliver e-mails.

I just encountered case when it was not. Customer had domain with only MX for sending emails and no A or AAAA records.

milo commented 2 years ago

And the conclusion?