Why does MailAddress think 'john@gmail.' is a valid email address?

Question

Like a good C# user, I use the MailAddress object to validate email addresses.

A client of mine entered john@gmail. for his email, which was validated by MailAddress, and broke my software. I'd expect the code below to throw an exception, but it doesn't.

static void Main(string[] args)
{
    string addressmail = string.Empty;

    try
    {
        MailAddress mail = new MailAddress(@"john@gmail.");
        addressmail = mail.Address;
    }
    catch (FormatException)
    {
        // address is invalid
    }

    // address is valid
    Console.WriteLine(addressmail);
}

Do you know how to catch this kind of bogus mail address?

it fails for me, ..oops you actually mean value within single quotes — V4Vendetta, Aug 24 '11 at 09:52
@Ofer Zelig: follow the link in the question, and consider the Regex. — Vinzz, Aug 24 '11 at 10:02
Sorry, it fails if i give it in single quotes, its not in your code sample (checked on 3.5) — V4Vendetta, Aug 24 '11 at 10:03
@Ofer Zelig: as jwz said: a dev had a problem. He thought: let's use Regex! Now, the dev had 2 problems... — Vinzz, Aug 24 '11 at 10:03
@V4Vendetta: did you try the code sample? against which version of ?NET? — Vinzz, Aug 24 '11 at 10:04
Did you consider that it's supposed (in my opinion) to throw an exception, and it's not? — Vinzz, Aug 24 '11 at 10:47
It doesn't throw an exception for me on .NET 4.0 -> I can confirm the problem you are seeing. — Daniel Hilgarth, Aug 24 '11 at 10:50
thanks Daniel, I restated the question, which obviously was somehow confusing. — Vinzz, Aug 24 '11 at 11:07
For example: Regex.IsMatch(addressmail, @"\A(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\Z", RegexOptions.IgnoreCase); — Ofer Zelig, Aug 24 '11 at 11:08
@Ofer: No one asked for a regex. Please read the points **against** using a regex in the question Vinzz linked. — Daniel Hilgarth, Aug 24 '11 at 11:14
This fails on: new MailAddress("FooBar Some@thing.com") resulting in .DisplayName = "FooBar" and .Address = "Some@thing.com". — Jan, Sep 18 '17 at 13:43

score 4 · Accepted Answer · answered Aug 24 '11 at 11:29

I think in this case, MS's implementation of a valid email address is incorrect, at least as per RFC822. I haven't actually tried your code, so I'm assuming it does as you say.

There are other ways to validate email addresses, such as actually connecting to the SMTP server and asking it to confirm that the address is valid (as explained here and here). Short of doing that, you will always have a bit of trouble. Personally, I don't think that it's worthwhile to spend too much time validating email address according to some specification (beyond the quick checks we have at our disposal; e.g. your code) - the real test is whether an email is received on that address if you send it. A simple email verification can confirm this, although I know it might not be appropriate in all cases, but in those, you are out of luck.

Well, this it the most reasonable approach. that said, I'm somehow disappointed by this implementation, considering the maturity of .NET — Vinzz, Aug 24 '11 at 11:43
M$ does [some normalization](https://stackoverflow.com/questions/7173401/c-sharp-email-validation-confused-by-mailaddress-behavior-johngmail-is-val#comment105829115_7176931) which may not be helpful, depending on how you use it. — Michael, Jan 21 '20 at 19:16

Efran Cobisi · Answer 2 · 2012-02-06T11:42:59.907

4

The MailAddress type has very limited support for validating email addresses and, as of .NET 4.0, does not support most of the related IETF standards. If you need to validate the syntax of your email addresses, possibly without using regular expressions, I suggest you to take a look at EmailVerify.NET, a .NET component that supports all of the current standards about the subject (RFC 1123, RFC 2821, RFC 2822, RFC 3696, RFC 4291, RFC 5321 and RFC 5322). Should you need to, the component even allows to perform additional tests on the addresses, including DNS, SMTP and mailbox checks.

EmailVerify.NET website: http://cobisi.com/email-validation/.net-component
Online demo: http://cobisi.com/email-validation/validate-address

Disclaimer: I am the lead developer for this product.

edited Feb 06 '12 at 11:42

answered Aug 24 '11 at 22:01

Efran Cobisi

6,138
22
22

Thanks for this hint, overkill for my current project, but definitely a component to keep in mind. – Vinzz Aug 25 '11 at 07:08
Disposable E-mail Address verification... that's naughty ;o) – Vinzz Aug 25 '11 at 07:10
A nice feature, I must confess. :) – Efran Cobisi Aug 25 '11 at 13:10
For those who are wondering, [disposable email addresses](http://en.wikipedia.org/wiki/Disposable_e-mail_address) is the official name for the temporary email addresses generated by so many providers out there (including filtzmail, 10minutemail, mailinator, despam and so on). [EmailVerify.NET](http://emailverify.net) allows to easily detect this kind of addresses. – Efran Cobisi Aug 25 '11 at 13:20

Vinzz · Answer 3 · 2011-08-24T15:50:19.237

1

Somehow fixed version, mixing MailAddress and a simple Regex to validate the host:

Static regex, as advised by SLaks

private static readonly Regex hostReg = new Regex(@"(\w+)\.(\w+)");

public bool IsMailAddress(string addParam)
        {
            try
            {
                MailAddress mail = new MailAddress(addParam);
                string address = mail.Address;

                //not handled by MailAdress, which is a shame
                return hostReg.IsMatch(mail.Host);
            }
            catch (FormatException)
            {
                //address is invalid
                return false;
            }
            catch (Exception)
            {
                return false;
            }
        }

edited Aug 24 '11 at 15:50

answered Aug 24 '11 at 14:14

Vinzz

3,968
6
36
51

1

You should cache the regex in a `static readonly` field. Also, `a@b` is valid (although rarely used); it would probably be better to check `!mail.Host.EndsWith(".")`. – SLaks Aug 24 '11 at 14:27
a@b ? oh my, what a spec... Thanks for the inputs! – Vinzz Aug 24 '11 at 15:45
one of my faulty input was 'john@gmail' so I'll stick with the regex, hoping my client isn't too eccentric. – Vinzz Aug 24 '11 at 15:48
I'm not even sure if `a@b.` is actually invalid. (I haven't read the spec) – SLaks Aug 24 '11 at 16:15
`a@b.` is technically valid (though usually a typo), but there are definitely still problems with the `MailAddress` parser: `a @a.b` will _return `true`_ in the function above because it's _normalized_ to `a@a.b`. But if you don't `new MailAddress(...).Address` when you save the string, you'll end up with something that _isn't_ a valid email address. Similar things happen with strings that M$ interprets as having a `DisplayName`: Try `a a@a.b` for example. – Michael Jan 21 '20 at 19:14

score 0 · Answer 4 · answered Aug 12 '16 at 15:55

MailAddress tries to be compatible with RFC2822 which obsoletes RFC822. When you read the source code of MailAddress you see that the end-dot it's accepted just for compatibility with some e-mail clients. Validating e-mail address with regex is not the right thing to do (see RFC2822), the best way is to implement a parser, what MailAddress did.

see DotAtomReader used by MailAddressParser

score 0 · Answer 5 · answered Aug 09 '17 at 18:00

Not a free solution but Cobisi's email validation library can tell whether the email valid or not within different level of accuracy (Syntax, IspSpecificSyntax, DeaDomain, Dns, DeaMailExchanger, Smtp, Mailbox, CatchAll)

var engine = new VerificationEngine();
var result = engine.Run("john@example.com",
                        VerificationLevel.Mailbox).Result;

if (result.LastStatus == VerificationStatus.Success)
{
    // TODO: Show a message box with the great news
}

Disclaimer: I am not related to the company or the project.

score 0 · Answer 6 · answered Aug 10 '17 at 01:09

MailboxValidator has a free API which you can use. Just need to sign up for the free API plan at http://www.mailboxvalidator.com/plans#api then the integration part is pretty easy since they also have a C# class http://www.mailboxvalidator.com/dotnet for you to wrap the API calls.

The C# class codes are in https://github.com/MailboxValidator/mailboxvalidator-csharp

To install MailboxValidator SingleValidation class via NuGet (https://www.nuget.org/packages/MailboxValidator.SingleValidation/), run the following command in the Package Manager Console:

Install-Package MailboxValidator.SingleValidation

Then you can just use the class like below:

using System;
using System.Windows.Forms;
using MailboxValidator;

namespace TestMailboxValidatorCSharp
{
    public class TestMailboxValidatorCSharp
    {
        static void Main(string[] args)
        {
            var mbv = new SingleValidation("PASTE_YOUR_API_KEY_HERE");
            String results = "";
            try
            {
                MBVResult rec = mbv.ValidateEmail("example@example.com");

                if (rec.ErrorCode == "")
                {
                    results += "email_address: " + rec.EmailAddress + "\n";
                    results += "domain: " + rec.Domain + "\n";
                    results += "is_free: " + rec.IsFree + "\n";
                    results += "is_syntax: " + rec.IsSyntax + "\n";
                    results += "is_domain: " + rec.IsDomain + "\n";
                    results += "is_smtp: " + rec.IsSMTP + "\n";
                    results += "is_verified: " + rec.IsVerified + "\n";
                    results += "is_server_down: " + rec.IsServerDown + "\n";
                    results += "is_greylisted: " + rec.IsGreylisted + "\n";
                    results += "is_disposable: " + rec.IsDisposable + "\n";
                    results += "is_suppressed: " + rec.IsSuppressed + "\n";
                    results += "is_role: " + rec.IsRole + "\n";
                    results += "is_high_risk: " + rec.IsHighRisk + "\n";
                    results += "is_catchall: " + rec.IsCatchall + "\n";
                    results += "mailboxvalidator_score: " + rec.MailboxValidatorScore + "\n";
                    results += "time_taken: " + rec.TimeTaken + "\n";
                    results += "status: " + rec.Status + "\n";
                    results += "credits_available: " + rec.CreditsAvailable + "\n";
                }
                else
                {
                    results += "error_code: " + rec.ErrorCode + "\n";
                    results += "error_message: " + rec.ErrorMessage + "\n";
                }

                results += "version: " + rec.Version + "\n";
                MessageBox.Show(results);
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message + "\n" + ex.StackTrace);
            }
        }
    }
}

Why does MailAddress think 'john@gmail.' is a valid email address?

6 Answers6

Linked