Determining the hostname/IP address from the MX record in PHP

Question

Hi there, have a basic email domain validation script that takes a user's email domain, resolves the IP address from that and then checks that against various published blacklists. Here is how I am determining the IP:

$domain = substr(strchr($email, '@'), 1);
$ip     = gethostbyname($domain);

The problem is that some email address domains, such as [email protected], use an MX record rather than an A record, so using gethostbyname('alumni.example.net') will fail to resolve. I know when a user's email is using an MX in the email itself by using the PHP checkdnsrr function, but once at that stage am a little stuck as to how to proceed.

In theory, I could parse out the 'root' domain, i.e. 'example.net' and check it, but I've not found reliable regex that can handle this task when the user could easily have an email the format of [email protected]...

So, any suggestions on how to best tackle this??

Answer 1

Try:

$result = shell_exec ('host -t MX '.$domain);

var_dump ($result);

or

exec ('host -t MX '.$domain, $result = array ());

var_dump ($result);

You will get list of MX records, you can parse it and check each record with gethostbyname().

Edit

dns_get_record() mentioned by Ycros will be better.

Answer 2

Instead of using gethostbyname, use dns_get_record, something like dns_get_record($domain,DNS_MX). See the docs for how the return values are structured.

Answer 3

The easiest is probably

if (!getmxrr($host, $result)) {
  $result=array($host);
}

Then loop over the results, calling gethostbyname() and checking that none are blacklisted (or you could pick the result with the lowest weight, but that could be easily used to circumvent the blacklist).

I'd question the usefulness of blacklisting a destination; DNS spam blacklists are usually made for blacklisting sources.

Answer 4

You cannot do source validation based solely on someone's e-mail address, because (in general) any party anywhere on the internet can send any e-mail with anyone else's e-mail address in it.