Check If Email Exists

Re:Check If Email Exists by femto113 on Friday July 02, 2021 @12:02AM (#27707696)

If they're checking using SMTP's VRFY command then it's actually considered a best practice for the server to always reply with a 252 "cannot verify" since otherwise it can be used to fish for valid addresses.

[ Parent | on HN ]

Re:Check If Email Exists by sildur on Friday July 02, 2021 @06:18AM (#27709780)

But... I could also fish for valid addresses by trying to send an email and waiting for a bounce...

[ Parent | on HN ]

Re:Check If Email Exists by e12e on Friday July 02, 2021 @07:00AM (#27709987)

Yes, and you could be eg: graylisted. Or server could accept all an silently drop. Or rate limit.

It's sad that VERIFY is basically dead due to spam. In the olden days, you might have been able to use finger - but it's also dead for (among other) similar reasons.

The spam cat and mouse game leads to quite silly situations for benign actors.

For some mx's you might be able to designate some ips as trusted, and do real verify for those.

[ Parent | on HN ]