Validating email addresses through temporary mail message

Question

I was given this project and have changed a lot of code on it, now I am going over the code to make sure that I know what everything does and can maintain it efficiently, and to make sure I want my name on it.

Here is the method they have been using to validate e-mail addresses from a textbox input.

private string ValidateEmailAddresses(string addressesIn)
{
    MailMessage msg = new MailMessage();

    if (!String.IsNullOrWhiteSpace(addressesIn))
    {
        string[] allAddresses = addressesIn.Split(";,".ToCharArray(), StringSplitOptions.RemoveEmptyEntries);

        foreach (string addy in allAddresses)
        {
            try
            {
                msg.To.Add(addy);
            }
            catch (FormatException)
            { }
        }
    }
    return msg.To.ToString();
}

Is there a better way to accomplish this task?

Answer 1

• Well, it really depends on why addressesIn is a string. If it's input from the user, as I suspect, it is a fine method.

• If I was to be a harsh critic I would ask why a method named "Validate" returns a string.

• I think if you rename the method to like "ScrubEmailAddresses" or "SanitizeEmailAddresses" and envision it in an app that lets a user input email addresses to send an email to, it's kind of nifty. Basically instead of a roll-your-own-validations approach this says "hey, let the framework do it for me!" by taking advantage of the fact that .NET will just throw a FormatException if you try to add an invalid address. It's a fairly decent server-side equivalent to a RegularExpressionValidator using the predefined email regex. I also agree with Mike McCaughan's comment mentioning there is a resource hit when having the framework throw an exception.

Answer 2

One option, you have, is to make the TextBox multiline and instruct the user to type one email address per line. By changing your method to accept a string array, you won't need to split the string just pass in the Lines property of the TextBox:

private string ValidateEmailAddresses(string[] addressesIn)
{
    MailMessage msg = new MailMessage();

    if (addressesIn.Length != 0)
    {

        foreach (string addy in addressesIn)
        {
            try
            {
                msg.To.Add(addy);
            }
            catch (FormatException)
            { }
        }
    }
    return msg.To.ToString();
}

A further thought, rather than returning the string of addresses, put this code in the Validate event handler for the TextBox. Then in the Catch block build a multiline string of the failed email addresses to display in a MessageBox to prompt the user to fix or delete the offending lines. Once all the addresses are validated, simply use the data in the textbox.

Answer 3

As icktoofay points out:

It rejects valid addresses like "Smith, Jane"@example.com

Check out this post for an interesting explanation without having to actually read the RFC.

The problem is with this section of code

addressesIn.Split(";,".ToCharArray() ...

As you are splitting on ; and ,, it will split on any quoted ; or , characters within the email address local part such as the one found in the above email address.

With the exception of that, this is a good piece of code to find out if you have a possibly valid email address. Yes, control flow logic based on an exception is generally bad, however unless this is a massive bulk operation it will not cause anything more than a minor performance hit. At the end of the day, the only way to find out if it is truly valid is to send a message to it and ask the recipient to click a link containing a cryptographically secure random sequence. However, some anti-spam systems will automatically follow links in emails so this does not validate whether you have a human being at the other end, so you could get them to manually enter a random code instead on a form linked from the email.

To summarise, you need to find a method of splitting the email addresses without accidentally splitting on quoted sections. Yes, you'd be mad to purposely register the email address "this;will,never,be;accepted;anywhere"@example.com or to set one up for one of your employees with an address like this. However, we had a customer using one of our systems recently and they requested a change to the email validation routine as their customer had an employee with an email address like David.O'[email protected] which our system was rejecting and they could not register.

This is why I like your approach of relying on the built in MailAddress object to validate, which as also suggested in the first comment in this article: Don’t trust the .NET web forms email regex validator (or most others).