search

truemail-rb / truemail

🚀 Configurable framework agnostic plain Ruby 📨 email validator/verifier. Verify email via Regex, DNS, SMTP and even more. Be sure that email address valid and exists.
https://truemail-rb.org/truemail-gem
MIT License
1.19k stars 60 forks source link

[ISSUE] MX validation succeeds with A record validation #78

Closed ckhsponge closed 4 years ago

ckhsponge commented 4 years ago

Issue Description

"gmail.con" is a common typo in email addresses. The domain lacks a MX record but has an A record. I would desire MX validation to return false but it succeeds. Perhaps there's a reason to accept the A record I'm not understanding. Thanks.

Complete output when running truemail, including the stack trace and command used
Truemail.valid?("abc@gmail.con", with: :mx) -> true
Truemail.valid?("abc@stanford.ed", with: :mx) -> true
bestwebua commented 4 years ago

Hi, @ckhsponge Truemail MX lookup based on RFC 5321. It consists of 3 substeps: MX, CNAME and A record resolvers. The point of each resolver is attempt to extract the mail servers from email domain. If at least one server exists that validation is successful. Iteration is processing until resolver returns true.

https://slides.com/vladislavtrotsenko/truemail/#/0/9

So, as you can see this behaviour is not a bug. But you can add to blacklisted domains all 'mail typo domains' which you consider necessary. As proposition maybe make sense to add ability configure mx validation flow in next release. What you think?

ckhsponge commented 4 years ago

Looks like you are correct! I didn't realize email could be delivered without a MX record.

Thanks for creating the gem.

bestwebua commented 4 years ago

You're welcome, @ckhsponge. I will add ability to configure only mx records validation flow in next release.

bestwebua commented 4 years ago

@ckhsponge, I have implemented ability to use not RFC MX lookup flow: https://github.com/rubygarage/truemail/pull/80, and now this option is available in 1.7.0 release. Cheers!

ckhsponge commented 4 years ago

Thanks for implementing! I think this could be very useful for strict implementations. We currently want to avoid false negatives so will probably just use a blacklist for now.