Mohammad Waseem

Posted on Jan 30

Mastering Secure Email Flow Validation with TypeScript on a Zero Budget

#security #typescript #validation

In modern digital ecosystems, validating email flows is crucial for ensuring reliable communication and preventing abuse such as spam or phishing. Traditionally, security teams rely on commercial solutions or complex infrastructure, which can be costly and resource-intensive. However, as a security researcher operating within a zero-budget constraint, I experimented with a lightweight, code-centric approach leveraging TypeScript to build an effective email validation system.

The Challenge of Validating Email Flows

Email validation isn't just about checking email address syntax; it involves verifying MX records, preventing spoofing, and ensuring the email isn't part of malicious activity. The key lies in building a system that can technically validate the authenticity of an email's routing and origins using minimal resources.

Embracing a Zero Budget Approach

Without funds for external APIs or advanced services, the solution pivots on open-source tools and core language features. TypeScript offers robust type safety and async capabilities, making it suitable for network-bound tasks such as DNS queries and SMTP interactions.

Core Components of the Validation System

1. Syntax Validation

First, validate email syntax using regex, a straightforward and resource-light approach:

function isValidEmailSyntax(email: string): boolean {
  const emailRegex = /^[\w.-]+@[\w.-]+\.[A-Za-z]{2,}$/;
  return emailRegex.test(email);
}

// Usage
console.log(isValidEmailSyntax("test@example.com")); // true

While simple, this prevents malformed inputs from proceeding further.

2. Domain MX Record Check

Next, verify that the domain possesses valid MX records to ensure email delivery is feasible. Using the dns module available in Node.js, this can be achieved without external dependencies:

import * as dns from 'dns/promises';

async function hasMXRecords(domain: string): Promise<boolean> {
  try {
    const records = await dns.resolveMx(domain);
    return records.length > 0;
  } catch {
    return false;
  }
}

// Usage example
hasMXRecords('example.com').then(console.log); // true or false

This step confirms that the domain is configured to receive emails, adding a layer of validation.

3. SPF Record and DKIM Check (Optional but Recommended)

Implementing SPF or DKIM validation requires DNS TXT record queries and interpreting policies, which can be complex but is feasible at a zero cost with open DNS query modules.

4. SMTP Connection Testing

Finally, connect to the SMTP server of the domain to verify that the email address exists and can accept messages. Using the net module, one can open a socket and simulate a handshake:

import * as net from 'net';

function testSMTP(domain: string): Promise<boolean> {
  return new Promise((resolve) => {
    const socket = net.createConnection(25, domain);
    socket.setEncoding('utf8');
    socket.on('data', (data) => {
      if (/^220/.test(data)) {
        socket.write('EHLO localhost\r\n');
      } else if (/^250/.test(data)) {
        socket.write('QUIT\r\n');
        socket.end();
        resolve(true);
      }
    });
    socket.on('error', () => resolve(false));
  });
}

// Usage
testSMTP('mail.example.com').then(console.log); // true if SMTP responds properly

This test checks SMTP responsiveness and potentially the existence of the mailbox.

Bringing It All Together

By combining syntax validation, DNS MX record checks, and SMTP responsiveness testing in TypeScript, you can construct a comprehensive, zero-cost email flow validation system. While it won't replace advanced commercial solutions, it provides a solid baseline for detection and validation.

Final Considerations

Always respect privacy and rate limits when performing DNS and SMTP checks.
Be aware that some servers might block or restrict scripted SMTP interactions.
Consider asynchronous processing to handle multiple validation requests efficiently.

This approach demonstrates that with a deep understanding of network protocols and open-source tools, robust security validation is achievable even without budget expenditure. It empowers security teams and researchers to maintain high standards of email validation using only core programming and networking skills.

References:

RFC 5321, Simple Mail Transfer Protocol (SMTP). https://tools.ietf.org/html/rfc5321
DNS Queries for MX Records. https://nodejs.org/api/dns.html
Open Source DNS Libraries. https://github.com/ipaddressjava/dnsjava

🛠️ QA Tip

I rely on TempoMail USA to keep my test environments clean.

DEV Community