Validate e-mail addresses using PHP

• Posted: April 8, 2008
• |
• Author: Regan Johnson
• |
• Filed under: PHP & MySQL, Programming, Tutorials
• |
• Tags: dns, email, mx records, mysql, php, spammers, tutorial, validate

As a PHP programmer, there are a lot of people in this world that piss me off - collectively I label them as spammers! About.com estimates there are 183 billion e-mails sent every day in the world, with over 70% being considered spam - Hell, no wonder why my internet bill is getting to be so expensive!

When building new scripts or applications, I am always looking for new ways to increase security and the quality of my user generated content (such as member profiles, posts, comments, etc). There is nothing more frustrating than having an excellent web application that is littered with spam.

The process I use to determine if an e-mail address is legitimate

There are a few steps in the process that I use to validate an e-mail address which, together, are built for speed and accuracy. I encourage you to decide which steps you would like to use in your script, as they can also be used separate from each other.

Before we get started, I wanted to note that these functions are not intended to be comprehensive, as we are only checking the domain for MX records, and not the individual e-mail on that domain (which is a bit more complicated then the intentions of this tutorial). With that being said these functions will help narrow down the verification process significantly!

Filter improperly formatted e-mail addresses

This step is a good, quick brush to make sure that the e-mail address is in the proper format. I recommend including this step at a minimum - using PHP’s built in RegEx function, preg_match.

The function

function verify_email($email){

    if(!preg_match('/^[_A-z0-9-]+((\.|\+)[_A-z0-9-]+)*@[A-z0-9-]+(\.[A-z0-9-]+)*(\.[A-z]{2,4})$/',$email)){
        return false;
    } else {
        return $email;
    }
}

Because this article is not about regular expression, I am only going to provide a brief explanation about what’s going on here. Basically, you would call this function (example below) passing in an e-mail address whose format you wish to validate. The regular expression checks that the proper parts of an e-mail address are in the correct places, contain the correct characters, and are the correct lengths - if the e-mail is not formatted correctly, it will return false.

How to use it

$email = 'test@domain.com';

if(verify_email($email)){
    echo 'Success - E-mail address appears to be valid';
} else {
    echo 'Error - E-mail address appears to be invalid';
}

// sdasda@asdasd.com - true
// asdasd$%@.faa.ca.ds - false

While this function will flag some blatant examples of spam, you will notice that some pretty spammy looking e-mails will make it past this step which isn’t all that great But don’t worry, we actually test the domain in the following step.

Check the DNS of the e-mail’s domain to make sure it has a proper MX Record

For those of you who don’t know, and MX Record is a piece of data on a domain name that tells other computers and servers what to do when someone sends an e-mail address to that domain. By checking to see if an MX Record exists using PHP, we are taking the e-mail verification one step farther - a check that the domain actually exists and it’s able to host e-mail boxes. We will accomplish this using another one of PHP’s built in functions, checkdnsrr.

The function

function verify_email_dns($email){

    // This will split the email into its front
    // and back (the domain) portions
    list($name, $domain) = split('@',$email);

    if(!checkdnsrr($domain,'MX')){

        // No MX record found
        return false;

    } else {

        // MX record found, return email
        return $email;

    }
}

When using this function, PHP will send a call to the domain of the e-mail address you are attempting to validate, and check its MX records. If they are present and valid, it will return true, otherwise it will return false - simple as that!

How to use it

$email = 'test@domain.com';

if(verify_email_dns($email)){
    echo 'Success - E-mail has a valid MX record';
} else {
    echo 'Error - E-mail does not have an MX record';
}

// omg@omgomgomgeh.com - false
// steve@apple.com - true

Putting it all together

Now that we have our functions, and some working examples, let’s put it all together to be one badass e-mail validation function.

Example

$email = 'test@domain.com';

if(verify_email($email)){

    // E-mail address looks to be in the proper format
    // lets check the MX records

    if(verify_email_dns($email)){

        // E-mail passed both checks
        echo 'Success - E-mail address appears to be valid.';

    } else {

        // E-mail is invalid, no MC record
        echo 'Error - E-mail domain does not have an MX record.';

    }

} else {

    // E-mail inst formatted correctly
    // so we don't even check its MX record
    echo 'Error - E-mail address appears to be invalid.';

}

// Our function to filter our bogus formatted addresses
function verify_email($email){

    if(!preg_match('/^[_A-z0-9-]+((\.|\+)[_A-z0-9-]+)*@[A-z0-9-]+(\.[A-z0-9-]+)*(\.[A-z]{2,4})$/',$email)){
        return false;
    } else {
        return $email;
    }
}

// Our function to verify the MX records
function verify_email_dns($email){

    // This will split the email into its front
    // and back (the domain) portions
    list($name, $domain) = split('@',$email);

    if(!checkdnsrr($domain,'MX')){

        // No MX record found
        return false;

    } else {

        // MX record found, return email
        return $email;

    }
}

There you have it folks! A nifty little function to help keep your user base clean, and spam free! It’s important to note that the lookup of a domain names MX Record in this manner is currently only supported on Unix based systems - Sorry Windows.

Extend it into your own projects

This post is a start to integrating and building these functions into your own projects. For example, On some personal projects, I have taken these functions even farther. Because the MX Record checks takes a second or two to complete, I developed a system to cache results that come back as positive in a database for quick access of common domain names.

Have fun experimenting! As always, if you have any questions, I would love to hear them, and will do my best to help you out!

Update

I changed the verify_email() function above to use preg_match instead of eregi for the regular expression. This method is much faster. Someone pointed out to me that the regex was not updated for allowing “+” within the address, something that is starting to catch on. I have made the changes, and tested things out. Thanks for pointing this out to me.

• (24) Comments
• Permalink
• RSS 2.0
• 
• 
• 
• 
•