Emailchecker Laravel Package

Getting Started

1. Install into the Laravel app:

   composer require aman00323/emailchecker
   

   Laravel's package auto-discovery should register the service provider. If the facade isn't aliased automatically, add it to config/app.php (or use the fully-qualified class name directly).

2. Publish config if offered, then review it before writing code:

   php artisan vendor:publish --tag=emailchecker-config
   

   Look for flags controlling which checks run (syntax, MX/DNS, disposable-domain list, role accounts, SMTP probe) and any timeout values. Start with the cheapest checks enabled and add SMTP only if you control the outbound network.

3. Smoke-test in tinker before wiring it into a flow. Facade/method names vary between releases, so confirm the exact signature in the README and dump the result object:

   use Aman00323\EmailChecker\Facades\EmailChecker;
   
   $result = EmailChecker::check('[email protected]');
   dd($result); // inspect isValid(), isDisposable(), reason, etc.
   

4. First use case: registration. Wrap it in a custom validation rule and attach it to your RegisterRequest:

   class RegisterRequest extends FormRequest
   {
       public function rules(): array
       {
           return [
               'email' => ['required', 'string', 'email', new VerifiedEmail()],
           ];
       }
   }
   

That's the minimum viable integration: install → config → tinker → validation rule. Everything else is refinement.

Implementation Patterns

Custom validation rule with a configurable failure policy. Don't hardcode "reject disposable" in the rule. Read the policy from config so you can loosen it in production without a deploy:

class VerifiedEmail implements ValidationRule
{
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        $result = EmailChecker::check($value);

        if (! $result->isValid() && config('emailchecker.strict')) {
            $fail('This email address could not be verified.');
        }

        if ($result->isDisposable() && config('emailchecker.block_disposable')) {
            $fail('Please use a permanent email address.');
        }
    }
}

Wrap the package behind your own contract. This is the single highest-value pattern for a small, single-maintainer dependency:

interface EmailVerifier
{
    public function verify(string $email): EmailVerdict;
}

Bind the package-backed implementation in a service provider. Your controllers, rules, and jobs depend on EmailVerifier, not the vendor facade — swapping to Kickbox/ZeroBounce or Laravel's built-in email:rfc,dns later becomes a one-file change.

Never block registration on expensive checks. A synchronous SMTP handshake can take seconds and will dominate your registration latency. Instead: validate syntax + MX inline, create the user, and dispatch a queued job for the deeper checks:

RegisterUser::dispatch($user);
// job calls EmailVerifier, sets $user->email_risk = 'disposable'

Cache aggressively. Email verification is deterministic for a given address over short horizons. Cache by hash, not plaintext:

$key = 'email-check:'.hash('sha256', strtolower($email));
$verdict = Cache::remember($key, now()->addDays(30), fn () => $this->verifier->verify($email));

Bulk imports. For CSV imports, use Bus::batch() with chunked jobs and RateLimiter (or ->delay()/->middleware('throttle')) so you don't hammer DNS resolvers. Cache MX results per domain — a 10k-row import usually touches a few hundred domains, not 10k.

Surface results in the UI without hard failures. A debounced endpoint returning { valid, disposable, suggestion } lets you show "Did you mean gmail.com?" or a soft warning on checkout, rather than a validation error the user can't act on.

Testing. Mock the facade or your own EmailVerifier in feature tests so the suite never makes real DNS calls; keep a small integration test group that hits the real package and is excluded from CI by default.

Gotchas and Tips

• Port 25 egress is blocked on most cloud hosts (AWS, GCP, Azure, Heroku). If the package does SMTP probing, it will hang or time out in production while working fine on your laptop. Disable SMTP checks in config or run them from a dedicated worker with outbound port 25.
• Catch-all domains are ambiguous, not invalid. Accept-all domains often return "unknown" or false positives. Treat that as a soft signal and never reject a real customer on it.
• Disposable-domain lists go stale fast. Check whether the package ships a static list or fetches one; if static, plan to publish/refresh the config periodically or accept a decaying hit rate.
• Fail open on transient errors. DNS timeouts and resolver blips are not proof the email is bad. Catch exceptions, log at warning, and let the request through — a bounce is cheaper than a lost signup.
• Config caching bites. Once you run php artisan config:cache, any env() calls outside the package's config file return null. Make sure the package's config file actually reads env vars and isn't reading them at runtime.
• Throttle your own endpoint. An unauthenticated "is this email valid" endpoint is a free email-probing service. Require auth or CAPTCHA, and rate-limit per IP.
• Privacy. Emails are PII. Don't log the address and the verdict together, don't store raw addresses in your verification cache, and set a short retention on verification records.
• Lock the version. With ~162 stars, zero dependents, and a single maintainer, treat this as a volatile dependency: pin an exact version in composer.json, watch the issue tracker, and keep the interface wrapper as your escape hatch.
• You may not need it. Laravel's built-in email:rfc,dns rule covers syntax + MX validation. Adopt this package specifically for disposable-domain and role-account detection — that's where it adds value over the framework.
• Extension points are limited. Most value comes from publishing config and composing it into your own rule/service. If you need custom scoring logic, build it on top of the raw result object rather than forking the package.