Should e-mail validation using DNS/MX record be used?

Question

I noticed that most scripts for e-mail validation do not use DNS information to ensure the given domain actually exists.

What are the reasons why one might not use DNS checks?

Does it actually reduce the number of fake e-mails or make a form more usable?

Example snippet:

$host = explode('@', $email);
if(checkdnsrr($host[1].'.', 'MX') ) return true;
if(checkdnsrr($host[1].'.', 'A') ) return true;
if(checkdnsrr($host[1].'.', 'CNAME') ) return true;

Answer 1

It might be slow to do so. If you do DNS validation in a form, it would be wise to use AJAX in some way to start validating before the form is submitted.

Other than that, your check would fail on addresses with literal IP addresses, but personally I wouldn't want to accept those on my web form anyway. I don't care if they're RFC822 compliant ;)

Answer 2

It makes DOS attacks on your mail server really easy to pull off.

Answer 3

Most sites, especially ones that retain login information, send confirmation emails after you sign up. This not only confirms the email address is valid but also confirms that the email address belongs to the submitter. Having a DNS lookup would be redundant unless you wanted to tip off the user that they misspelled their email address.

And if I wanted to put in a fake email address, [email protected] (AAA, the auto club) and [email protected] (from RFC 2606) would both pass. I don't think a DNS lookup would catch as many fake addresses as you think.