HACKER Q&A
📣 akdor1154

How does Experian determine whether a given Gmail address exists?


Experian is selling an email validation service: https://www.experian.com.au/email-validation . This seems to, somehow, do live detection of whether a given gmail address exists.

To test this, I tested the result for a non-existing dummy address was 'invalid', then registered a gmail account with that dummy address, then re-checked the result to be 'valid'. As far as I could tell, there was nothing sent to the new account (so e.g. they aren't just checking for a bounce from a test email)

How can this work? This basically allows for user existence enumeration, which I would expect Google might frown upon. Reckon they are abusing some Google API in some way? (e.g. I'm having fuzzy thoughts about calendar invites, doc sharing, etc.) I am working under the assumption that they have special-cased detection for Google accounts; I haven't checked other email providers. Obviously their service could not possibly work in the general case.


  👤 greenyoda Accepted Answer ✓
I think you could validate an address by initiating an SMTP session to send an e-mail to that address, then aborting it. After issuing the RCPT (recipient) command, you'll get back a status code from the server telling you if the recipient is valid (250) or invalid (e.g., 550). At that point, you send QUIT without sending any DATA (so no message will be sent if the e-mail address is valid).

There are examples of successful and unsuccessful RCPT attempts here (scroll down to the second sample SMTP session):

https://en.wikipedia.org/wiki/List_of_SMTP_server_return_cod...

This is an entirely valid use of the SMTP protocol (getting back that status code is how you find out if a message to an address was undeliverable), but I suppose that if an e-mail provider wanted to prevent this kind of validation, they could stop accepting connections from subdomains of Experian that repeatedly aborted their SMTP sessions.


👤 phillipseamore
In the old days you'd simply connect to the domains SMTP and do either a VRFY or start sending an email and then aborting. Google doesn't allow this. However when signing up to Gmail you are notified if the username is taken, so they might be using something like that.

👤 smt88
Disclaimer: I don't work for Experian. I suspect only one of their devs could answer this affirmatively.

There are different approaches. As a sibling comment mentioned, you can use any login protocol that responds with a different message for users vs. non-users.

Off the top of my head, you have POP, IMAP, SMTP, OAuth, Gmail's undocumented HTTP API, Gmail's documented HTTP API, and web scraping.

You probably can't do any of those at scale.

To solve the scale issue, you could buy databases of verified email addresses, which are not expensive. For any address found in those databases, you know it's registered.

If it's not in your database, you can do a live check.

Alternatively, you could make a business arrangement with Google, which is also possible for a company like Experian.