Does anyone know a way to check if an email address is associated with spam sites? I'm looking to add a check prior to allowing someone to register on my church's website. Apparently my church is a target for bad guys.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
There is no easy way to check. The best thing you can do is use CAPTCHA to verify that it is a real human registering.
You could also keep your own list of not allowed emails for any users that are abusing your site. You could then ban those emails from being used to register / login on your site.
The problem is email addresses are easily obtainable -- are you willing to deny access to all gmail, hotmail, yahoo, etc domains (and even if you were, that's not at all a tenable solution)?
If you'll let us know what you are specifically trying to accomplish we can help /w a solution to your problem.
If you intend to send email to the addresses people have signed up with (e.g. church newsletters, etc.), I strongly recommend using a "Confirmed Opt-In"/"Closed Loop Confirmation" approach to prevent malicious users from signing up addresses that don't belong to them.
One way to do it is to send a single confirmation email as part of the signup process, asking them to click a link back to your site to confirm that they wish to receive email from you, and explaining that no further email will be sent if they don't confirm. The link should be difficult to guess, otherwise the bad guys will be able to confirm the signup without ever seeing the confirmation email.
When the link gets visited, you enable the account. If they don't confirm within a reasonable amount of time, silently deactivate the account -- don't pester them with reminders!
May be blank, comment, trackback, pingback, or a made up value like "registration".
You'll have to tie this into your code, but it might be worth it.
If you don't like the idea of building your own CAPTCHA, consider outsourcing the authentication using something like OpenID. You can even outsource that to someone else. I use RPX for authentication on my blog, and that allows your visitors to use their pre-existing facebook, twitter, google, yahoo, myspace and openID accounts.
Another option to investigate may be Greylisting on your mailserver to assist in mitigating spam.
In a nutshell, the pro is that you will tend to stop a lot of mail from spam applications that do not use a proper mailserver, but you do sacrifice delivery time in doing this.