Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone know a way to check if an email address is associated with spam sites? I'm looking to add a check prior to allowing someone to register on my church's website. Apparently my church is a target for bad guys.

Thanks

share|improve this question

migrated from stackoverflow.com Aug 27 '09 at 1:46

This question came from our site for professional and enthusiast programmers.

6  
You realize spammers do not use their own email addresses, right? –  Sinan Ünür Aug 27 '09 at 0:42
2  
and that they create dozens of free emails each day. –  Mohamed Aug 27 '09 at 0:55
    
Are you looking for a blacklist? –  samjetski Aug 27 '09 at 1:05
    
What can someone do if he/she registers on your website? Think from the perspective of what you are trying to prevent. –  DmitryK Aug 27 '09 at 1:10
add comment

7 Answers

The problem is email addresses are easily obtainable -- are you willing to deny access to all gmail, hotmail, yahoo, etc domains (and even if you were, that's not at all a tenable solution)?

If you'll let us know what you are specifically trying to accomplish we can help /w a solution to your problem.

share|improve this answer
3  
-1 This is a non-answer and should be comment. –  Sinan Ünür Aug 27 '09 at 0:44
add comment

There is no easy way to check. The best thing you can do is use CAPTCHA to verify that it is a real human registering.

You could also keep your own list of not allowed emails for any users that are abusing your site. You could then ban those emails from being used to register / login on your site.

share|improve this answer
add comment

One way is to set your own spam filter. I assume you've received many of them. So, look for common patterns and set the filter rules.

share|improve this answer
add comment

If you don't like the idea of building your own CAPTCHA, consider outsourcing the authentication using something like OpenID. You can even outsource that to someone else. I use RPX for authentication on my blog, and that allows your visitors to use their pre-existing facebook, twitter, google, yahoo, myspace and openID accounts.

share|improve this answer
add comment

If you intend to send email to the addresses people have signed up with (e.g. church newsletters, etc.), I strongly recommend using a "Confirmed Opt-In"/"Closed Loop Confirmation" approach to prevent malicious users from signing up addresses that don't belong to them.

One way to do it is to send a single confirmation email as part of the signup process, asking them to click a link back to your site to confirm that they wish to receive email from you, and explaining that no further email will be sent if they don't confirm. The link should be difficult to guess, otherwise the bad guys will be able to confirm the signup without ever seeing the confirmation email.

When the link gets visited, you enable the account. If they don't confirm within a reasonable amount of time, silently deactivate the account -- don't pester them with reminders!

share|improve this answer
add comment

Another option to investigate may be Greylisting on your mailserver to assist in mitigating spam.

In a nutshell, the pro is that you will tend to stop a lot of mail from spam applications that do not use a proper mailserver, but you do sacrifice delivery time in doing this.

share|improve this answer
add comment

I found that Akismet is really useful for more then just comment spam. The comment-check method accepts a parameter of comment_type which is documented as:

May be blank, comment, trackback, pingback, or a made up value like "registration".

You'll have to tie this into your code, but it might be worth it.

share|improve this answer
    
commenting down here because thats the only place i have enough rep to, but how did this get kicked off SO? isnt it a question about how to outsmart the spammers and skript kiddies like stackoverflow.com/questions/450835/… is? –  mwalling Aug 27 '09 at 2:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.