66

I found some websites that claim to verify if email addresses are valid. Is it possible to check if an email address is valid using just PHP?

<?php
    if($_POST['email'] != ''){
        // The email to validate
        $email = $_POST['email'];

        // An optional sender
        function domain_exists($email, $record = 'MX'){
            list($user, $domain) = explode('@', $email);
            return checkdnsrr($domain, $record);
        }
        if(domain_exists($email)) {
            echo('This MX records exists; I will accept this email as valid.');
        }
        else {
            echo('No MX record exists;  Invalid email.');
        }
    }
?>
<form method="POST">
    <input type="text" name="email">
    <input type="submit" value="submit">
</form>

This is what I have right now. It checks if the domain exist, but it cannot check if the user's email exist on that domain. Is it possible to do that using PHP?

4
  • 4
    Yes, send them an email and see if they response. Otherwise no, because spammers.
    – Hamish
    Oct 9, 2013 at 2:29
  • 4
    The only reliable way to validate an email address is to send an email to it. Even if you validate the MX record, you can't reliably query the server because most email servers won't respond to the queries. Thank your friendly neighbourhood spammers for this.
    – user1864610
    Oct 9, 2013 at 2:29
  • 1
    stackoverflow.com/a/566121/2812842
    – scrowler
    Oct 9, 2013 at 2:31
  • 5
    You can't do it 100%. Check out how these people did it. It's about a thorough as you can get
    – Casey
    Oct 9, 2013 at 2:34

4 Answers 4

48

You can't verify (with enough accuracy to rely on) if an email actually exists using just a single PHP method. You can send an email to that account, but even that alone won't verify the account exists (see below). You can, at least, verify it's at least formatted like one

if(filter_var($email, FILTER_VALIDATE_EMAIL)) {
    //Email is valid
}

You can add another check if you want. Parse the domain out and then run checkdnsrr

if(checkdnsrr($domain)) {
     // Domain at least has an MX record, necessary to receive email
}

Many people get to this point and are still unconvinced there's not some hidden method out there. Here are some notes for you to consider if you're bound and determined to validate email:

  1. Spammers also know the "connection trick" (where you start to send an email and rely on the server to bounce back at that point). One of the other answers links to this library which has this caveat

    Some mail servers will silently reject the test message, to prevent spammers from checking against their users' emails and filter the valid emails, so this function might not work properly with all mail servers.

    In other words, if there's an invalid address you might not get an invalid address response. In fact, virtually all mail servers come with an option to accept all incoming mail (here's how to do it with Postfix). The answer linking to the validation library neglects to mention that caveat.

  2. Spam blacklists. They blacklist by IP address and if your server is constantly doing verification connections you run the risk of winding up on Spamhaus or another block list. If you get blacklisted, what good does it do you to validate the email address?

  3. If it's really that important to verify an email address, the accepted way is to force the user to respond to an email. Send them a full email with a link they have to click to be verified. It's not spammy, and you're guaranteed that any responses have a valid address.

8
  • 3
    this don't check if email exist .. it is like regular expression validation Dec 23, 2014 at 3:53
  • 7
    he does not suggest that is does check if the email exists, just that its format is a valid one. Apr 19, 2015 at 12:08
  • 4
    As I said in my answer, there's no foolproof check to see if an email exists. Not every server will tell you an account is invalid if you try to send an email to it and if you start spamming a server with junk test requests it can get you blacklisted (i.e. Spamhaus, etc)
    – Machavity
    Apr 19, 2015 at 12:57
  • 2
    @BarışKURT And what if sss.com happily accepts both and just dumps the non-existent one without telling you? I am continually amazed by the insistence that somehow there's a magical way to determine that email exists for all email. Some servers will tell you if it exists but many will not
    – Machavity
    Oct 2, 2016 at 1:13
  • 1
    By the way, my upvote is not for the simple validation, which anyone should be doing without thinking about it, but rather for correctly observing that you simply can never rely on server responses to determine email account status, if you could, every spammer in the world would use such a method to validate their email databases to avoid sending to dead emails, which costs them money. The fact they do not use these methods, but rely on either server hosted images with query strings, or clicks to links that then validate the email, is actually all you need to see to get that it can't be done.
    – Lizardx
    Mar 21, 2017 at 1:38
48

Update 2023: Today this will get you blocked, if it works at all. See comments.

You should check with SMTP.

That means you have to connect to that email's SMTP server.

After connecting to the SMTP server you should send these commands:

HELO somehostname.example
MAIL FROM: <[email protected]>
RCPT TO: <[email protected]>

If you get "<[email protected]> Relay access denied" that means this email is Invalid.

There is a simple PHP class. You can use it:

http://www.phpclasses.org/package/6650-PHP-Check-if-an-e-mail-is-valid-using-SMTP.html

5
  • 3
    This script is great, however, when i tested it on outlook, live and hotmail servers the response code 554 appears on emails that exist, and then the script hangs until it is timed out
    – TMMDev
    Aug 25, 2014 at 10:30
  • 5
    I tried the class and every valid email comes back with "valid, but not exist!" Jun 15, 2015 at 21:30
  • 10
    This is technically true, but pratically inadvisable: ISPs (especially Yahoo and Hotmail) know about this and they will block deliveries from you (even to addresses that do exist) if you do this a lot. In short, don't do it.
    – Synchro
    Jun 22, 2016 at 6:26
  • 1
    @SolaOderinde Maybe the email you've checked have a catchall entry. With this entry you can configure that the mail server should redirect every email which isn't catch by an existing email address to this email account. Therefore every syntactical correct email address would be valid for this server even if there isn't a separate mailbox for this email address. Feb 14, 2023 at 16:06
  • 1
    Please validate the mail only syntactically using other methods. As of 2023, there should be no reliable technical way to validate the existence of mail addresses (other then sending to it) - if there was, this would be a great way for SPAMmers to SPAM even more.
    – Alex
    Jul 14, 2023 at 8:43
4

I have been searching for this same answer all morning and have pretty much found out that it's probably impossible to verify if every email address you ever need to check actually exists at the time you need to verify it. So as a work around, I kind of created a simple PHP script to verify that the email address is formatted correct and it also verifies that the domain name used is correct as well.

GitHub here https://github.com/DukeOfMarshall/PHP---JSON-Email-Verification/tree/master

<?php

# What to do if the class is being called directly and not being included in a script     via PHP
# This allows the class/script to be called via other methods like JavaScript

if(basename(__FILE__) == basename($_SERVER["SCRIPT_FILENAME"])){
$return_array = array();

if($_GET['address_to_verify'] == '' || !isset($_GET['address_to_verify'])){
    $return_array['error']              = 1;
    $return_array['message']            = 'No email address was submitted for verification';
    $return_array['domain_verified']    = 0;
    $return_array['format_verified']    = 0;
}else{
    $verify = new EmailVerify();

    if($verify->verify_formatting($_GET['address_to_verify'])){
        $return_array['format_verified']    = 1;

        if($verify->verify_domain($_GET['address_to_verify'])){
            $return_array['error']              = 0;
            $return_array['domain_verified']    = 1;
            $return_array['message']            = 'Formatting and domain have been verified';
        }else{
            $return_array['error']              = 1;
            $return_array['domain_verified']    = 0;
            $return_array['message']            = 'Formatting was verified, but verification of the domain has failed';
        }
    }else{
        $return_array['error']              = 1;
        $return_array['domain_verified']    = 0;
        $return_array['format_verified']    = 0;
        $return_array['message']            = 'Email was not formatted correctly';
    }
}

echo json_encode($return_array);

exit();
}

class EmailVerify {
public function __construct(){

}

public function verify_domain($address_to_verify){
    // an optional sender  
    $record = 'MX';
    list($user, $domain) = explode('@', $address_to_verify);
    return checkdnsrr($domain, $record);
}

public function verify_formatting($address_to_verify){
    if(strstr($address_to_verify, "@") == FALSE){
        return false;
    }else{
        list($user, $domain) = explode('@', $address_to_verify);

        if(strstr($domain, '.') == FALSE){
            return false;
        }else{
            return true;
        }
    }
    }
}
?>
1
1

As of 2023, there should be no reliable technical way to check the existence of mail addresses. If there was, this would be a great way for SPAMmers to SPAM even more, because they easily could scan for valid emails.

The only way is to send opt-in mails. This does not only check if the address exists, but also if it is the correct one for this user. It does not help if the address exists but belongs to someone else. In some countries like Europe this is even legally required.

Not the answer you're looking for? Browse other questions tagged or ask your own question.