Why does filter_var($email, FILTER_VALIDATE_EMAIL) allow test@test?

Question

I was just setting up the validation for a form in which I decided to try using the filter_var function to check the validity of my email address. I can not find out what filter_var actually allows anywhere though (since the documentation is very simple), and I found out that it is allowing an email address like test@test. Doesn't there have to be a .com, .net etc... in the domain?

Answer 1

The behavior has changed somewhere around April. See bug #49576 and revision 297350.

That e-mail is indeed invalid, or at least that's what the PHP developers understood. The source carries this notice:

/*
 * The regex below is based on a regex by Michael Rushton.
 * However, it is not identical.  I changed it to only consider routeable
 * addresses as valid.  Michael's regex considers a@b a valid address
 * which conflicts with section 2.3.5 of RFC 5321 which states that:
 *
 *   Only resolvable, fully-qualified domain names (FQDNs) are permitted
 *   when domain names are used in SMTP.  In other words, names that can
 *   be resolved to MX RRs or address (i.e., A or AAAA) RRs (as discussed
 *   in Section 5) are permitted, as are CNAME RRs whose targets can be
 *   resolved, in turn, to MX or address RRs.  Local nicknames or
 *   unqualified names MUST NOT be used.

The changelog mentions this bug fix for PHP 5.3.3 and PHP 5.2.14.

Answer 2

It is a valid email address. It isn't going to work on the Internet (at least, not today), but it is fine for a local address.

I would assume that the developers are taking the sensible approach to checking email addresses and not building themselves a system that is guaranteed to go out of date as soon as a new TLD is introduced. We have enough email address syntax checkers that reject [email protected] as it is.

Answer 3

No, test can be a local / internal network domain, so that would work. I like it that it correctly validates wrikken@localhost when developing for instance.

A normal nonexistentdomain.foo would have the same problem. If you want to test whether something is delivarable to a host, use getmxrr (and it that fails fall back to gethostbyname()).

Answer 4

test@test is syntactically valid.

From RFC 5321:

In the case of a top-level domain used by itself in an email address, a single string is used without any dots.

Only after this does it say:

Only resolvable, fully-qualified domain names (FQDNs) are permitted when domain names are used in SMTP. In other words, names that can be resolved to MX RRs or address (i.e., A or AAAA) RRs (as discussed in Section 5) are permitted, as are CNAME RRs whose targets can be resolved, in turn, to MX or address RRs. Local nicknames or unqualified names MUST NOT be used.

This does not necessarily preclude TLD-only domain names. In fact, run the following code:

checkdnsrr('ua', 'MX') // Returns true

getmxrr('ua', $array) // Returns true

TLD-only domain names (can) have MX records and are in use: http://www.to/ is an example. And here's some valid TLD-only domain name email addresses:

vince@ai

paul@io

root@km

joost@tk

admin@tt

hostmaster@ua

Source of example email addresses: Tony Finch – TLDs with MXs