Email address validation
Checks an address for syntax, a mail-capable domain, and obvious risk before sending, without pretending it proves the mailbox belongs to someone.
See it
What it is
Email address validation is a stack of checks before sending: parse the address, reject impossible syntax, look up whether the domain can receive mail, and optionally flag disposable domains such as mailinator.com, role addresses, or known-risk results. It is useful at signup because catching 'gmial.com' before it enters the list is cheaper than bouncing a welcome sequence later.
Validation estimates risk; double opt-in proves control. DNS can show that a domain accepts mail, but it cannot prove that a particular mailbox exists or belongs to the person typing it. SMTP mailbox probes are routinely blocked, rate-limited, or defeated by catch-all domains, so a vendor's 'valid' result is never a delivery guarantee.
The failure mode is overconfidence disguised as strictness. A giant regex rejects legal addresses, disposable-domain lists go stale, and a domain without an MX record may still receive mail through the address record fallback defined by SMTP. Normalize whitespace and the domain, suggest typo corrections without silently changing the address, and send a confirmation link when ownership actually matters.
Ask AI for it
Build server-side email address validation in Node.js. Parse and normalize the address without a homemade giant regex, lowercase the domain, preserve the local part, and use dns.promises.resolveMx to check mail routing. Follow RFC 5321 by checking A or AAAA records when no MX record exists instead of automatically rejecting the domain, but reject an explicit Null MX because it declares that the domain accepts no email. Flag disposable and role-based addresses as risk signals, not proof of invalidity, and return typo suggestions such as gmail.com for gmial.com without silently rewriting user input. Add a double opt-in confirmation email as the only ownership check, rate-limit the endpoint, cache DNS results with a short TTL, and test plus-addressing, internationalized domains, null MX, DNS failure, and catch-all domains.