Email validation at signup: what to check, and what not to

import re

# Deliberately permissive: one @, something before it, a dotted domain after it.
BASIC = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")

def normalize(addr: str) -> str:
    addr = addr.strip()
    local, _, domain = addr.rpartition("@")
    return f"{local}@{domain.lower()}"

def looks_like_email(addr: str) -> bool:
    return len(addr) <= 254 and bool(BASIC.match(addr))

from difflib import get_close_matches

COMMON = ["gmail.com", "yahoo.com", "outlook.com", "hotmail.com", "icloud.com"]

def suggest(domain: str):
    if domain in COMMON:
        return None
    match = get_close_matches(domain, COMMON, n=1, cutoff=0.85)
    return match[0] if match else None

Layer 3: domain and MX lookup#

Check that the domain can receive mail:

1. Look up MX records for the domain.
2. If there are none, RFC 5321 allows falling back to the domain's A or AAAA record as an implicit MX.
3. If the domain publishes a null MX (MX 0 ., RFC 7505), it explicitly does not accept mail. Reject.
4. If the domain does not exist (NXDOMAIN), reject.

import dns.resolver

def domain_accepts_mail(domain: str) -> bool:
    try:
        mx = dns.resolver.resolve(domain, "MX", lifetime=3)
        hosts = [r.exchange.to_text() for r in mx]
        return not (len(hosts) == 1 and hosts[0] == ".")
    except dns.resolver.NXDOMAIN:
        return False
    except dns.resolver.NoAnswer:
        try:
            dns.resolver.resolve(domain, "A", lifetime=3)
            return True
        except Exception:
            return False
    except Exception:
        return True  # DNS trouble: do not block the user, let confirmation decide

Fail open on DNS errors. A slow resolver should not cost you a signup.

Layer 4: risk checks, chosen deliberately#

Disposable address services provide temporary inboxes. Whether to block them is a product decision: they are popular with people trying a product without commitment, and also with abusers creating many accounts. Lists of disposable domains exist, but they go stale quickly. If you block, make the error message clear and offer an alternative.

What not to do: SMTP probing#

Some services "verify" addresses by connecting to the recipient's mail server and issuing RCPT TO without sending a message, to see whether the server accepts the address. Avoid doing this yourself at signup:

• Many large providers accept all recipients at the SMTP stage, or answer ambiguously, so results are unreliable.
• Repeated probing from your IPs looks like directory harvesting and can hurt your reputation or get you blocked.
• It adds seconds of latency to a form submission.

A confirmation email gives a definitive answer without any of these problems.

Layer 5: confirm the address#

For accounts and subscriptions, send a confirmation email with a single-use link or code. Until the address is confirmed:

• Do not send marketing or digests.
• Limit what the account can do, if appropriate.
• Expire unconfirmed signups after a reasonable period.

Confirmation proves the address works, proves the person controls it, and eliminates typos and maliciously entered addresses at once. Make the email fast and simple, because a slow confirmation step loses signups.

Protect the form itself#

Signup forms are abused by bots that submit victims' addresses, sometimes in large volumes, to flood inboxes with confirmation emails. Rate-limit by IP and by address, add bot protection on high-traffic forms, and never send more than one confirmation email to the same address within a short window.

Checklist#

• Trim input and use a permissive syntax check.
• Allow plus addressing and long top-level domains.
• Suggest corrections for typos in common domains; never auto-correct.
• Check MX records, handle null MX and NXDOMAIN, and fail open on DNS errors.
• Decide deliberately about disposable domains.
• Do not perform SMTP probing at signup.
• Confirm addresses before sending ongoing mail.
• Rate-limit the form against bot abuse.

Bottom line#

Layered validation keeps garbage out without rejecting real users: permissive syntax checks, typo suggestions and DNS lookups cost almost nothing and catch most mistakes. Confirmation emails catch the rest with certainty. Skip SMTP probing, fail open on DNS problems, and protect the form from bots, and your bounce rate and trap exposure will both stay low.