How can I prevent users from entering invalid e-mail addresses at registration?

Question

Sometimes users mistakenly input the wrong e-mail address upon user registration. When this happens, they are unable to activate their account, because the password is e-mailed to their e-mail address (or, in my case, I'm actually using Logintoboggan, but they still need to click the link in their e-mail before their account can be activated).

Often in this situation, the user will realize their mistake and simply re-register. This is ok, but then I have to clean up the accounts that never get activated, which is a pain. I've noticed that the Drupal 7 registration will accept a bad domain in the e-mail address by default (for example, yahoo.co.jap, which is an invalid TLD). When I realized this, I thought surely someone has already written a module to cover this use case (making sure users input a valid e-mail address on registration), but I was unable to find it. Does such a module exist?

Answer 1

Drupal validates the email since Drupal 5; since Drupal 7, valid_email_address() (the function used to validate the email entered during registration, or when editing a user account) calls filter_var().
The code used to validate the email address doesn't check if the domain exists, the username doesn't contain typos, or the domain has an active email server. While it would be possible to check if the domain has an email server by looking at its MX records with checkdnsrr(), it would be more difficult to verify if the username is correct, as most of the SMTP hosts doesn't return a useful value for the VRFY command (which means they always return ERROR, or OK).

Notice that the documentation for getmxrr() contains the following note.

This function should not be used for the purposes of address verification. Only the mailexchangers found in DNS are returned, however, according to RFC 2821 when no mail exchangers are listed, $hostname itself should be used as the only mail exchanger with a priority of 0.

I would rather do as @Letharion suggested, and implement hook_cron() to get ride of those accounts created by users who didn't type their email correctly. For Drupal 7, I would use the following code.

function mymodule_cron_queue_info() {
  $queues['mymodule_delete_users'] = array(
    'worker callback' => 'user_delete_user', 
    'time' => 30,
  );

  return $queues;
}

function mymodule_cron() {
  $query = new EntityFieldQuery();

  $query->entityCondition('entity_type', 'user')
    ->entityCondition('entity_id', 1, '>')
    ->propertyCondition('access', 0)
    ->propertyCondition('created', REQUEST_TIME - MYMODULE_DELAY, '<')
    ->addTag('DANGEROUS_ACCESS_CHECK_OPT_OUT');

  $result = $query->execute();

  if (isset($result['user'])) {
    $queue = DrupalQueue::get('mymodule_delete_users');
    foreach (array_keys($result['user']) as $uid) {
      $queue->createItem($uid);
    }
  }
}

The module should define the constant MYMODULE_DELAY, and set it to an appropriate value.

Answer 2

This doesn't answer your question, but perhaps solves your problem.

Use a Rules rule or a hook_cron implementation that removes accounts that have never been logged into, but created more than X days ago.

Answer 3

Consider using Inactive Users module, to send a warning first and then delete the inactive modules.