Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
Checking my Sendgrid account I've noticed many drops due to "Known bad domain". Those bad domains often seem to have been caused due to user mistake.
***@gmal.com
***@gmail.com.br
***@hotmal.com
I was thinking of silently fixing a select few before saving them to the database.
Is this common practice or are there reasons why I shouldn't attempt to fix those bad domains?
On it's own, tt's a pretty bad idea
***@gmail.com and ***@gmal.com might both be valid emails and not belong to the same person.
One argument in favour is: an attacker could register for common misspelled domain names, and get access to the users emails including sensitive information like password reset links, etc.
A solution could be to send the fixed address and email asking for the user to visit the site, verify it's him (using phone number or other private data) and force him to correct the email.
If you have control over where you get your email addresses from, I think it would be better to check this on the client side and ask them to verify the email is correct when you detect one of these domains. Chances are they will fix it and then you do not need to assume. You might even catch some mistakes outside the domain name as well.
If you do not have control over the origin of your email list, as well as for your existing bad cases, you might want to make sure there are not any legal issues doing this. If someone was just trolling the email while filling out a form, you may end up sending an email to someone who does not want to get emails from you when you fix the domain. As laws like GDPR are passed around the world, this might increasingly be a problem.
