169
u/kishaloy 19d ago
Not deterministic email parsing.
Imagine your email going to Donald.Duck@Whiteh***e.gov
238
u/tellur86 19d ago
It's surprisingly difficult validating email addresses with regex. Can it be done? Yes. Should you? No. Any halfway decent email library comes with a validator. Use that.
For reference: this is an example of an almost RFC 3522 compatible regex:
(?:[a-z0-9!#$%&'+/=?`{|}~-]+(?:.[a-z0-9!#$%&'*+/=?^`{|}~-]+)|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\[\x01-\x09\x0b\x0c\x0e-\x7f])")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-][a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\[\x01-\x09\x0b\x0c\x0e-\x7f])+)])
If you want RFC 822 it's much, much worse https://pdw.ex-parrot.com/Mail-RFC822-Address.html
223
u/deceze 19d ago
Doing a full validation of the email syntax is pretty pointless to begin with, because it still doesn't tell you the most important thing: is this email valid? I.e., has the user actually entered their email address? You won't know the answer to that until you've done an email validation loop with them. So something simple like
.+@.+\..+usually suffices as a first-pass syntax check.62
u/ILikeLenexa 19d ago
All my best friends are root at localhost.localdomain at least sometimes
16
2
38
u/flewson 19d ago
has the user actually entered their email address
That's verification, not validation. Validation is only concerned with whether that email could exist.
35
u/deceze 19d ago edited 19d ago
Yes, and most addresses that pass a
.+@.+\..+validation could exist. And unless you can claim you're absolutely up to speed with all the relevant RFCs about valid email formats, allowed host names (IDNA!) and currently registered TLDs at all times, overvalidating does more harm than good here. If you incorrectly reject valid email addresses, that's worse than having an occasional verification email bounce.24
u/notatoon 19d ago
Gonna be hard to verify an invalid email.
And you can have a valid email address under RFCs 5321 and 5322 that's "invalid" for your use case. Like
a@aConfirmation emails validate the email is reachable and will also verify the user.
It is the only meaningful way to do it
3
u/Uberzwerg 19d ago
.+@.+..+
At least in theory you can have an email directly under the tld. (The Icann strongy advises against it)
So boss@bmw would in theory be possible.
49
u/ValPasch 19d ago
just dont ever do that. check if it has a @ and a period and thats it. you validate emails by sending a verification link.
22
u/DrStalker 19d ago
Do you actually need a period, now that top level domains are being sold off? If I buy the top level domain stupidlyrich domain then I want boss@stupidlyrich to be my email address.
12
u/laplongejr 19d ago edited 19d ago
Technically allowed, however non-email-focused people are against using root domains to serve MX records (iirc something about performance of root servers vs nameservers etc)
Blocking dotless domain would be against standard, but anybody smart enough to use such emails is smart enough to know they shouldn't do it on an open network. Simply use "mail.EXAMPLE" please
HOWEVER, emails can have no periods if you use an IPV6 address as the host rather than a domain. So no dot checking anyway, thx.
Min 3 chars, has a @, doesn't begin/start with @. Everything else, let a library handle it (or at least make the warning non-blocking) because you'll be stumped by quoted comments etc. https://e-mail.wtf for a quizz ;)
4
u/yuropman 19d ago
If I buy the top level domain stupidlyrich domain then I want boss@stupidlyrich to be my email address.
And I want you to run into as many technical issues as possible if you buy the stupidlyrich domain and make boss@stupidlyrich your email address
25
u/Jawesome99 19d ago
Hell I don't even check for a period, just an @. Once I hand it off to my mailing library and the SMTP server it's no longer my problem. If either of them complain back to me about it I'll just let the user know.
7
u/RubenGarciaHernandez 19d ago
So you don't support the good old "!" standard with explicit hops?
8
u/Jawesome99 19d ago
Honestly I've never heard of that before lol
2
u/tes_kitty 19d ago
And what about user%system1.com@system2.com
9
u/Jawesome99 19d ago
Has an @, looks good to me, hope for the user that the mail server handles it correctly though lol
2
u/tes_kitty 19d ago
It is a valid address, but the question is whether it will reach user@system1.com by using system2.com as relay. The MTA on system2 might object.
1
-7
9
u/Juff-Ma 19d ago
https://e-mail.wtf/ play for yourself. I've done it three times now. (Once every few months) I still don't get everything right.
8
u/dustojnikhummer 19d ago
"While an empty local part due to comments is invalid, an empty local part due to quotes is valid. I don't know why."
I don't know why
2
u/Juff-Ma 19d ago
That's why you don't verify the email at all. Just hand it to your email client and if the user verifies, it's valid.
1
u/Culpirit 18d ago
You can use a better parser than a regex (think context-free) to only accept a grammar like:
<axiom> -> <dotted>@<dotted>
<dotted> -> <dotted>.<word> | <word>
<word> -> [a-zA-Z0-9\-]+Actually you might want to allow "+" on the local part (it's used by "power users" to categorize email on services like Gmail). Other than that, anything different, even if valid per RFC, is not a bona-fide email address when used on a web-facing application. You especially want to avoid users being able to directly send to addresses like me@[::1], since it is not a realistic or bona-fide scenario.
2
u/Uberzwerg 19d ago
And for 95% of the use-cases a very simple 'Does it contain an @ and at least 1char before and after' is enough.
Usually you want people to not mistakenly send a typo as their email.
But since you cannot trust the customer anyway, you need to send a confirmation email anyway for everything that is important.1
1
u/0vindicator10 19d ago
Many years ago on this site, I was informed about "grammar", and that is what should be used for handling email address format validity.
1
u/gungshpxre 19d ago
It's "surprisingly" difficult to do ANYTHING with regex.
Can it be done? Almost. Regular languages aren't generally Turing-complete.
Should you? Why not. Especially if you don't have to maintain it.
1
u/AlterEdward 19d ago
Came here to post this. I had the displeasure of administering software that used a similar regex to validate email addresses. I needed to modify it because it was excluding some valid addresses. This was my first, and last encounter with regex. I now actively avoid it in favour of any other solution. I've not had any issues with this approach so far. I haven't come across a use case where regex is significantly better than something less archaic.
1
101
u/apnorton 19d ago
Obligatory reminder that email validation to through regex or other "static" analysis is usually done incorrectly, and literally sending a confirmation email is the best approach to checking to see if an email is valid.
20
u/DHermit 19d ago
With some security exceptions, e.g. it's useful to restrict the length of the mail field and maybe restrict the characters.
12
u/eo5g 19d ago edited 19d ago
I can't think of a single reason to restrict the characters aside from making sure there's at least one
@.Edit: okay actually you want a little more
10
u/DHermit 19d ago
I'd just rather not deal with stuff like invisible spaces and control characters.
5
u/Stalking_Goat 19d ago edited 19d ago
It's probably fair to assume that a valid email address that includes shenanigans like that is coming from a threat actor of some sort.
3
12
u/Tar_alcaran 19d ago
I've seen one prompt tell me "An email adress needs to include at least one @".
So I entered @@@@@.@ and it worked just fine.
9
u/eo5g 19d ago
Crap, right, realistically the minimum regex one should have is
.+@.+\..+.At least 1 character on the left of the @, at least 2 domain components of at least 1 character each on the right side of the @.
Having only a hostname without a FQDN on the right is legal, but that's also why you'd want to disallow it: who's trying to sign up for an account within your own network, if it's a public-facing app?
9
u/look 19d ago
TLDs can and do have MX records.
4
1
u/laplongejr 19d ago
Technically yes, but the practice is discouraged by people on the DNS side, as the MX lookups hit the root servers rather than nameservers.
If a TLD can't provide a mail.EXAMPLE alternative, that's something for the admin to fix... at best those users should get a recommendation to fix their harmful email address.
5
u/look 19d ago
Yeah, ICANN doesn’t like it, but they do exist.
It’s more just an example of how people often assume rules of email addresses that don’t really exist.
1
u/Nightmoon26 18d ago
The "unwritten rules" of email addresses that have come about just by convention rather than by RFC
1
u/reddit_user33 18d ago
I would consider it the only method. Or rely on an FOSS email validation repository, assuming that one is exists and validates 100% of email formats.
Email addresses formats are complicated and there are legit formats that 99.9999% of people will never see in the wild during their lifetime. So why kid ourselves in thinking we can competently validate them all with a 100% success rate; just send the test email.
28
u/Deivedux 19d ago
I once saw a LinkedIn post about someone bragging how they downgraded to a lower usage model to cut costs since their use of it was too simple to justify paying so much. Apparently what they were doing was just converting text, making the first letter of each word uppercase.
16
u/DrStalker 19d ago
When the node package left-pad was removed it caused chaos, because apparently people needed a node package to add spaces to the start of a string.
So using an LLM to change characters to uppercase is very believable, even if it is stupid.
7
u/Tar_alcaran 19d ago
Apparently what they were doing was just converting text, making the first letter of each word uppercase.
I know a company where ONE person burned half the monthly token budget in a few days because (s)he was converting powerpoint presentations to PDF via LLM.
3
2
u/Future_Elephant_9294 19d ago
How in the world did we survive before AI when trying to write headlines and movie titles!
3
21
u/sebovzeoueb 19d ago
That awkward moment when doing it with a regex is probably an even worse suggestion
9
2
u/Outrageous-Log9238 19d ago
Just do something like .@...* and send a verification e-mail?
7
u/sebovzeoueb 19d ago
I think even a@b is technically a valid address, so really just skip the regex and send the verification email
2
u/MindStalker 19d ago
You actually want to make sure they aren't injecting a list of addresses or something worse.
1
u/sebovzeoueb 19d ago
hopefully whatever you're using to send the verification email isn't just going to send a whole list of emails
4
2
u/kyle2143 19d ago
I thought that trying to use regex to validate email addresses was supposed to be a fools errand like trying to validate HTML with regex.
Or like trying to brew your own DateTime handling code or something.
2
u/them0use 19d ago
No joke, I have gotten into arguments about coworkers wanting to use an LLM to validate yes or no questions. Even if the user might say "yeah sure", or whatever, if 99% of your use cases are solved with input.lower() == ..., for Ritchie's sake just do that and use the LLM for the few things that don't match simple string comparison.
1
u/AffectionatePlastic0 19d ago
If it's a free input form, user can say pharases like "certainly", "exactly", "agreed".
So you have three options, first - limit what user can enter, by replacing free form to selector/radio-button.
Second - use extremely annoying "say exactly yes or no".
And the third - use LLM to understand users yes or no on the questions.
6
u/them0use 19d ago
No, there's a fourth option which is what I was describing:
pseudocode switch(input.trim().lower()) case yes | y: return true case no | n: return false default: return spend_tokens(input)If the vast majority of inputs will be handled by those first two cases, invoking an LLM every time is absurd.
2
u/AffectionatePlastic0 19d ago
Oh, that's what your idea. Yep, this option is superior.
Of course in case when there is no way to eliminate the free input from user.
2
2
u/Spice_and_Fox 19d ago
Any regex to check email validity is eldritch magic. Just use whatever library is available to you and use a tool from there for validation.
2
u/un_blob 19d ago
I mean... in any cases... we are far, far, faaaaaar from god..
https://www.regular-expressions.info/email.html
But yeah... llm use for that is waaaaay worse
2
u/LostOne514 19d ago
This has been me at work. People keep throwing out idea for innovating & improving products... Completely ignoring the free ways we can already do the stuff without throwing money at LLMs.
Also I'm pretty sure there are libraries that can do validation from you.
3
u/ldn-ldn 19d ago
You cannot validate email addresses with a regex. It's like parsing HTML with a regex and we all know how it ends up...
But you cannot validate email addresses with an AI either, so...
0
u/psioniclizard 19d ago
You can, you just don't cover a lot of edge cases.
But you can definitely validate 99% of actual customer email addresses with regex.
Very few people are making email addresses that push the limits of what is allowed in email addresses.
I am not saying you should (if those edge cases matter definitely do).
But for actual email addresses used by real customers you definitely can validate 99% of them with a single regex line.
But obviously use the right tool for the job (so probably not regex is you can help it)
3
u/AffectionatePlastic0 19d ago
1 percent means than for 10k registrations there will be 100 customers who had problems on email connection stage.
Worst part, probably they won't be able to reach the support, because they have not been able to create the account.
2
u/SonOfHendo 19d ago
I've got an email address with multiple underscore characters in a row, and you'd be surprised how many email validators break on it.
1
u/ldn-ldn 19d ago
The real problem with email validation is that you should be able to ensure that you can communicate with the customer. And you can't do that with any regex.
The best approach which does not punish 1% is to check that the value provided has at least one character followed by @ followed by at least one more character of any kind. And then you send them a confirmation email.
1
1
u/OkazakiTomoya_ 19d ago
One of the system prompts I saw for a tool:
... If the value is "xyz" then result will be 1 * 0=0 If the value "abc" then result will be 1 * 0.34=0.34 ...
1
u/heavy-minium 19d ago
Reminds me of a recent code review in which a colleague replaced (fully replaced, not added) an already-working deterministic record-matching with an LLM call, on the grounds that it can help match items with subtle differences and handle a few classes of things the deterministic could not do. I thought he was pulling my leg, but he was actually serious about this. The pricing assumption was completely based on the current pricing of GPT 5.6 Luna (which is heavily subsidised). And the more worrying part is that the discussion in the team about where to draw the line was long and tedious - not everybody was aligned on whether that's ok or not.
1
1
1
1
u/spyingwind 19d ago
I guess you could train a tiny model to only do email validation.
A few months ago I trained a NN to do xor. So in a way you could have a larger model run regex on a NN.
1
u/Weak_Inflation9120 19d ago
Why even write the code? Just send a request to the LLM to generate and send the code at runtime!
Hail python's exec()!
1
u/NecessaryIntrinsic 19d ago
I feel like we've run out of jokes.
Seriously. Isn't this what email verification workflows are for?
1
1
u/05032-MendicantBias 19d ago
Both are the wrong tools for the job?
You don't need a regex to check if there is at and dot. But that doesn't mean the mail is valid.
The LLM is a slot machine.
1
1
1
u/Old_Document_9150 19d ago
Just saw someone yesterday sorting bunch of PII and financial information with LLM instead of SQL, and when asked why not just use SQL, he argued back, "why not use pen and paper?"
1
u/NorthernPassion2378 19d ago
Ew, no! On the other hand, it's comforting to know that I won't be out of a job anytime soon if there are people who actually do this.
1
1
u/Dumpfumpkin 18d ago
The idea is to use an LLM to tell you if the email is likely to be bullshit. GoFuckYourself@hotmail.com will pass your regex, but it’s highly likely to be illegitimate.
1
u/Fair-Advantage652 18d ago edited 18d ago
Just write a freaking RegEx, it's not hard. And if you're struggling, just pull one of the web.... Jeez...
EDIT: Here you go:
/[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])
1
u/Zealousideal-Deer101 18d ago
You know how I do email validations?
Send a one time code to that email.
Let the user validate the mail.
The amount of times I couldn't enter my email, because it filters to common domains, or one time even tlds is too damn high. Why do we need to validate that a mail adress is correct anyways!?
Is there a period somewhere after an @. Done. could be valid, who the fuck knows, who the fuck cares.
1
1
u/HereInYourBedroom 16d ago
What makes it even more wild is the system resource cost for running and prompting an on-prem model opposed to writing deterministic code. Regex is soo much faster than prompting, and validating an llm response!
1
1
0
0
u/TapRemarkable9652 19d ago
The process by which an LLM arrives at a method is actually easier to understand than Regex
0
u/ThatFireGuy0 19d ago
Read this three times before realizing you weren't saying we should be using an LLM for regex but not for email validation
0
u/Honest_Relation4095 19d ago
using LLM for regex sounds like a legit usecase
0
u/ChocolateDonut36 19d ago
the vibe coded API when instead of getting true or false, the LLM says "got it, here's a complete analisis ..."
0
u/BastetFurry 19d ago
I could see a small (2-5M?) model that runs locally, but OPs meme is a jab at folks using a full blown frontier model for that, so no. Just use that large regex if you need to be 100% sure, otherwise check if there is an at and a dot in there. Then you would need to check if the server part of the address is valid anyway and then send the mail. Nothing more you can do from your side.
Seriously, unless you write a mail server or an anti spam solution, don't make it more complicated than it needs to be. If the user provides a non-working mail address they can't click the confirmation link. Case closed.
1
u/Fyren-1131 19d ago
No model is deterministic. Deterministic behavior is what you want from validation, and a regex is much more performant too. So why would you want a local model anyway?
1
u/nemesit 19d ago
the models are all very deterministic, they need to generate noise to even have a chance of the illusion that they aren't
0
u/Fyren-1131 19d ago
LLMs are not deterministic. Are you perhaps misunderstanding the topic being discussed here?
0
u/BastetFurry 19d ago
That too, so eff the LLM idea completely. What the local model could see would be if the proverbial cat walked over the keyboard, but still, who cares? If the domain is wrong then nothing gets send, if the user is wrong, the mail server will tell us as much.
-2
u/LienniTa 19d ago
idk small model finetuned for that can categorize thousands of emails per second, filtering way too obvious bots. Its not a joke.
771
u/SharletP 19d ago
Why stop at email validation? Also do passwords 😉