Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I noticed that there is an email address validation method, that is to telnet to a email MX server and send rcpt command to the server. But for this method, the MX server may abort connection after several tests.

However, on Internet, there are many websites which claim that they can verify large amount of email addresses in short time, and they provide such services with charges.

I'm wondering how do these email verification companies/websites verify large amount of email addresses?

share|improve this question
add comment

5 Answers

They don't, it takes less work for them to simply send emails out to invalid addresses than it does to weed out the invalid ones.

share|improve this answer
    
This is why spam works for them... false positives are just too cheap. –  Joel Coehoorn Dec 21 '12 at 18:43
    
While true, a mailer daemon's "undeliverable" message is a common way to clean up a mailing list. That makes it a popular anti-spam feature; some mail programs/providers, when you mark a message in your quarantine as "spam", will send a fake Undeliverable response to the sender, and if the mail-bot cares they'll remove your address from the list. –  KeithS Dec 21 '12 at 19:12
    
You're presuming that they will get the undeliverables. If they are spoofing the source email address the undeliverable won't go to them. –  GdD Dec 21 '12 at 19:36
    
... and in that case they don't care. –  KeithS May 9 '13 at 19:19
add comment

In my experience, most MTA's won't actually verify E-Mail addresses if you connect to them for the exact reason that it allows people to enumerate valid addresses. Usually they'll either reject the VRFY command and/or accept mail for any user specified in the RCPT line and then silently drop mail for invalid ones.

As to services that say they'll validate addresses, I'd take that claim with a pinch of salt. Whilst it's possible to do things like send mails to every one on the list and count bounces try to use other methods (e.g. web bugs) to verify live addresses, none of these approaches is foolproof.

One other approach they may take is to validate supplied addresses against lists that they've got from elsewhere, but again not a foolproof method.

share|improve this answer
    
you meant RCPT don't actually verify E-mail addresses? –  wenzi Dec 21 '12 at 11:17
1  
Depnds on the MTA. I've seen many where they'll just take the mail regardless of who you put it to (at the domain that they work for anyway). The decision to process will come later eitehr on that system or another that it forwards it to. –  Rоry McCune Dec 21 '12 at 11:21
    
I dont get your point, let's take gmail for example –  wenzi Dec 21 '12 at 11:26
1  
sure if you do RCPT TO: <invalidemailaddress@gmail.com> it might accept that and pass it to another server which will then determine whether the address is valid or not, and just drop it if it's not. In a lot of corporate setups the internet facing MTA doesn't actually have access to the directory of valid users so it can't make that decision, it just accepts the mail and forwards it to a server that can make the decision. –  Rоry McCune Dec 21 '12 at 11:28
2  
yep, depends on the MTA as I say some will actually check and return it some won't. on gmail, no idea that one's tricky they have a lot of accounts.. –  Rоry McCune Dec 21 '12 at 12:17
show 1 more comment

Most spam campaigns rely on botnets to do the real work, so having individual nodes blacklisted as spammers due to sending lots of emails to non-existent addresses isn't a big deal for them. Often they'll just harvest as many addresses as possible and go nuts, without any real verification.

One of the smarter approaches I've seen is to send "legitimate" newsletters, which aren't likely to get flagged as spam, and include a few links to product pages and an unsubscribe link. Users that click any of the links are immediately flagged as active. This reduces the chance of having the messages blacklisted by spam filters, and makes the spam efforts more efficient.

share|improve this answer
    
thanks, but it seems that the answer is not for my question? –  wenzi Dec 21 '12 at 11:28
    
@wenzi Yes, sorry, my answer does kinda side-track a little. I figured you were interested in how it's done in various situations. –  Polynomial Dec 21 '12 at 11:30
    
Even easier is serve the images in the e-mail from a unique URL that identifies that the user viewed the mail, no clicking required. Much like hit-counters etc. –  John U Dec 21 '12 at 13:04
    
@JohnU Except most email clients don't show images by default for exactly that reason. –  Polynomial Dec 21 '12 at 13:06
    
@Polynomial - True enough, but how many thousands of luddites out there are still running "old" clients or who are not savvy enough to realise this and click "load images"... –  John U Dec 21 '12 at 13:15
add comment

There are many methods. You can send mail with a review un subscribe link, that will in fact register you as valid and active. You can create a real service that ask for email to users (newsletter, forum inscription) with a confirmation method, then use them for other purposes. My favourite one would be the creation of a website that can send an image for all request you make to him. Send HTML messages that include an image and uses a personalised link. When the mail client download the image for display, register the mail associated to the link. This method can be used with large images as well as 1x1px images for stealth. Some antivirus may detect some of these attacks.

share|improve this answer
    
Don't know if I should +1 for answering or -1 for explaining how to spam to a bunch of kiddies... –  Joshua Drake Dec 21 '12 at 19:02
add comment

In some cases they simply don't rely on SMTP methods. Instead they place a personalised link in a spam mail, like http://example.com/news5/display.php?M=537686&C=eee9c997b0e958fa373533c5f4. If someone clicks on that link a spammer can conclude that the email was received and therefore the address is working.

If a spammer provides the kind of verification service you described, he might simply have a database of known working addresses and checks the supplied addresses against the database.

Nowadays most mail servers have countermeasures against checking if email addresses exist. So I assume this is not working on a larger scale.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.