How to check if a received email is legit? - php

Question

I'm developing a system which gets emails from PIPE, verify if the email address which from the email was sent is in the client database, and write it into the database.
The problem is that I don't want to have security issues, and if someone sends an email with PHP to the system, it will log it too. So, how can I check if the email was sent by the properly mail server? I was thinking in getting the IP of the mail server of the domain and verify in Email Headers if it was sent from these server. So, if I got an email from test#hotmail.com, it would ping mail.hotmail.com and check if the email came from these IP address.
Anyway, if someone got a custom domain like yourdomain.com, running in a shared cPanel server, other people in these server could send emails with PHP and get the IP verify passed. So, I was thinking in checking if the email was sent with PHP or from a mail server, but I don't know how to do this.
What is your suggestion?

Answer 1

I was thinking in checking if the email was sent with PHP or from a mail server
You will not be able to find out the difference between these two normally. And email sent with PHP can look exactly the same like an email from a mail server and it is likely the case that an email sent with PHP is also an email from a mail server.
You can try to write a detection on your own (your own filter) based on the monitoring you do and finding out about wrong mails (or those reported back from your users if you can not monitor the emails deeply because of law regulations).

Answer 2

I found http://verify-email.org/ for you. They have an API so you can check the email adress by that service.
EDIT
When you check an email adres on the website you see this result:
MX record about gmail.com exists.
Connection succeeded to alt3.gmail-smtp-in.l.google.com SMTP.
220 mx.google.com ESMTP tz3si2159695bkb.62 - gsmtp
> HELO verify-email.org
250 mx.google.com at your service
> MAIL FROM: <check#verify-email.org>
=250 2.1.0 OK tz3si2159695bkb.62 - gsmtp
> RCPT TO: <test#gmail.com>
=550-5.1.1 The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 tz3si2159695bkb.62 - gsmtp
You can build your own check by logging in to an smtp server and send the commands you see above:
> HELO verify-email.org
> MAIL FROM: <check#verify-email.org>
> RCPT TO: <test#gmail.com>
You can check for errors or success messages in the output you get. I think it's not difficult to build in php.

Answer 3

Eh, this is my first time answering anything so sorry if I misunderstood. Anyways, if you're doing a check for the email in PHP, I have something that might be able to help;
If($_POST['email']){
$Email = $_POST['email'];
$Allowed = array('gmail.com', 'yahoo.com', 'ymail.com', etc..);
If(filter_var($Email, FILTER_VALIDATE_EMAIL)){
$Domain = array_pop(explode('#', $Email));
If(!In_Array($Domain, $Allowed)){
Echo 'Your response here...';
}}}
or for checking the email's characters, you can call a function or check it yourself;
Function checkEmail($Email){
return preg_match("/^[\.A-z0-9_\-\+]+[#][A-z0-9_\-]+([.][A-z0-9_\-]+)+[A-z]{1,4}$/", $Email);
}
So it'd be something like;
checkEmail('email#domain.com');
That checks the input, and if it doesn't have the email characters, you can choose what to do.
Hope this helped!

Answer 4

Yes, there are many Email Verification tools out there. I personally like www.verifyemailaddress.org
But there are plenty of those tools to find.