How can I implement following logic?
User registers with an e-mail address
If provided e-mail address is a valid email address Then user account get's activated
or if it is a fake email then user account is not activated
I doubt that I can catch the - "Delivery failed reply message", right? anyhow how would you suggest to implement the above logic?
PS. I will have to find a way no matter what, client wants it =)
You probably want to be sure not only that the e-mail address is valid, but also that it belongs to this particular user. The usual way to do this is to send an e-mail with a link. The user has to click the link to activate the account.
For example, the link could look like this:
http://example.com/activate?token=bc59fb46c9a0a25346889e5ab336f11c
where the token is a random string that you generated and stored in your database, linked to that account. The server-side code behind the activate page will then activate the account. If you don't get a hit for this token within, say, a week, you can clean up the account and the activation token.
Addition in reply to your comment...
An alternative way would be to initiate an SMTP connection, and try to begin sending an e-mail. This is similar to callback verification amongst mail servers. For example (< is what the mail server says, > is what your script might send):
< 220 example.com ESMTP Postfix
> EHLO foobar.com
< 250 OK
> MAIL FROM: noreply@foobar.com
< 250 OK
> RCPT TO: johndoe@example.com
< 550 Recipient address rejected: User unknown in local recipient table
> QUIT
< 221 Bye
There are several serious problems with this approach, which is why it is not used in practice. Most of these will result in incorrectly accepted messages, some will cause the check to fail entirely:
hotmail.com, pretty much any address you can imagine will be taken.See also the Postfix manual and a disputed section on Wikipedia. I hope this list is long enough to convince your client that there is no good solution to his problem, and that he should stop asking the impossible from you.
why don't you implement a verification system. They create an account. send them an email with a verification number. they click the link in the email and then run through that database and activate that particular verification id.
many website use this technique and it helps keep some kind of control.
Hope this helps
You can also use the PHP function checkdnsrr($hostname). For example:
if (checkdnsrr("comcast.net"))
{
echo 'Email valid!'
return true;
}
else
{
echo 'Email invalid!';
return false;
}
This will return true and echo "Email valid!" because comcast.net is a valid ISP. This function, at least, will prevent your users from entering 'johndoe@foobar.com".
Look into Regular Expressions, it is a way that you can validate the email's format to ensure it's a valid email structure (ie. contains an "@", has a top level domain, a domain, etc.)
That will just ensure the email is valid, but a fake email like fakeMan@FakeLand.com would still pass. To ensure that the email is real, you'd need to send an email through a mail server, and check for bounce backs. That process could take a while, because you'd have to wait for the email server to respond with a bounce back, which is hard to predict how long that will take. If you want your users to wait a couple of days, then that's fine.
The standard is to validate the email to make sure it's the right format, using Regular Expressions. Then what you do is send a verification key to the user's email. They need a valid email to then get the key, to complete the sign up process.
Of course, there are still users who use temporary emails to sign up for sites. It's an email that exists for 24 hours or so, enough to get them the verification key... There's no real way to get around users who do this, other than blacklisting all the services that do this (and there are lots.)
This is the true email syntax regular expression: http://ex-parrot.com/~pdw/Mail-RFC822-Address.html
You see, it is not a trivial job.
