Test for Existence of Email Server

[ben1960]

The conditional test in the following function is derived from the first edition of "Web Database Applications with PHP and MySQL." This book was published by O'Reilly. Using the PHP function "getmxrr" makes prefect sense. However, I am unsure about the usefulness of the "checkdnsrr" test.

Code: Select all

<?php

function test_email_server($email)
{
	if (!(getmxrr(substr(strstr($email, '@'), 1), $temp) || 
		checkdnsrr(gethostbyname(substr(strstr($email, '@'), 1)), "ANY")))
	{
	    return false;
	}
	else
	{
		return true;
	}
} 
       
?>

[joemuller]

The snippet you posted only attempts to see if an MX record exists for the domain via getmxrr(), which could be invalid or incomplete. The ANY check via checkdnsrr() isn't very reliable either, because ANY requests are not required to return MX records (and some servers will refuse to answer at all, as ANY requests have often been leveraged for amplification attacks).

I highly recommend looking over the guidelines on the OWASP Input Validation page over here:
https://www.owasp.org/index.php/Input_V ... Validation

In short, the only real way to verify whether an email address is valid is to do the bare minimum checks (at least one '@' with a destination domain on the right-hand-side), then attempt delivery.