2

Checking my Sendgrid account I've noticed many drops due to "Known bad domain". Those bad domains often seem to have been caused due to user mistake.

***@gmal.com
***@gmail.com.br
***@hotmal.com

I was thinking of silently fixing a select few before saving them to the database.

Is this common practice or are there reasons why I shouldn't attempt to fix those bad domains?

5

On it's own, tt's a pretty bad idea

***@gmail.com and ***@gmal.com might both be valid emails and not belong to the same person.

One argument in favour is: an attacker could register for common misspelled domain names, and get access to the users emails including sensitive information like password reset links, etc.

A solution could be to send the fixed address and email asking for the user to visit the site, verify it's him (using phone number or other private data) and force him to correct the email.

  • @DocBrown true, addressed the point – RMalke Jul 5 '18 at 17:59
  • I hadn't thought about the attacker point of view. It's definitely a pretty bad idea then. – Breno Gazzola Jul 11 '18 at 18:07
7

If you have control over where you get your email addresses from, I think it would be better to check this on the client side and ask them to verify the email is correct when you detect one of these domains. Chances are they will fix it and then you do not need to assume. You might even catch some mistakes outside the domain name as well.

If you do not have control over the origin of your email list, as well as for your existing bad cases, you might want to make sure there are not any legal issues doing this. If someone was just trolling the email while filling out a form, you may end up sending an email to someone who does not want to get emails from you when you fix the domain. As laws like GDPR are passed around the world, this might increasingly be a problem.

  • 3
    exactly, and any decent signup process will send a verification email first (also helps with the GDPR consent problem). If the user confirms that the verification email was received you know it's the correct address, even if it looks like a typo. – amon Jul 5 '18 at 15:04
  • I'm not very fond of confirmation emails on signup and my attempt to fix domain names was the reduce the number of mistakes without having to resort to them. But with your point and @RMalke's I think I will have to use it. – Breno Gazzola Jul 11 '18 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.