Determining the health/validity of an email address

Question

Routine maintenance on a website often involves verifying that links are valid, flagging bad ones, etc.

I know how to match email addresses via a script (especially in the context of a web page where they'd be in mailto: links). My question is how would I verify they're OK without spamming the address?

Stripping-off the domain and verifying it's listening on port 25 is a partial answer, but doesn't handle verifying the username/alias.

Is there a way to add this to my maintenance scripts for websites I manage?

I don't really care what language it's written in, so long as it works :)

Answer 1

SMTP used to have a 'VRFY' command, which asked the server if it believed the username was valid. Everyone turns that off now, to prevent spamming.

It also used to be possible to start sending an email, "MAIL FROM: ...", "RCPT TO: ...", and the receiving server would let you know right after the RCPT TO if the address wasn't any good. That doesn't work anymore, either.

This is a long winded way of saying, "No, I don't think there is a way to do that, without actually sending an email."

Answer 2

A better way of doing this is to wait until you have a normal email to send to the subscription list, and include in it a request for anyone wanting to stay on the list to fill in a form within a reasonable time period. After that, you can just assume the ones who didn't respond don't want any more mail and remove them.

Answer 3

It depends how accurate you need it, as the earlier answer states you can use the SMTP server interface via script. Then it's only so accurate, and even if you send an email it may not ever be 100% accurate, some SMTP servers may accept the email, but then discard it, or some email addresses may not be used, but still accept mail.

There is no replacement for doing by hand, you will only be able to get to a certain confidence level by automation, but not 100%.

Answer 4

Agree with Jay: All the nifty features built to do this particular job are generally turned off...

The only way is sending an email to that address; and even then, you're not 100% sure.

• That address can be garbage; nobody's checking it.
• Mailbox is full (temporarily?) and you get a DSN
• SMTP server glitches/outages

IMHO, keep checking the domain (go easy on connections if you don't want to get blacklisted) and antispam tools like akismet/spamhaus to filter user subsmissions.