EmailValidator

EmailValidator is a PHP library for validating email addresses against multiple RFCs (5321, 5322, and related standards) using a proper lexer/parser rather than a single fragile regex. It supports pluggable validation strategies — strict RFC compliance, DNS MX record checking, spoof-character detection, and a lenient “no warnings” mode — and is a foundational dependency used by Symfony, Laravel, and many other PHP frameworks.

What You Get

• A EmailLexer/Parser pipeline that tokenizes and validates email addresses against RFC 5321/5322 grammar
• Multiple pluggable validation strategies: RFCValidation, NoRFCWarningsValidation, DNSCheckValidation, and MultipleValidationWithAnd for combining strategies
• A SpoofCheckValidation strategy leveraging PHP’s intl extension to detect homograph/spoofing attacks in email addresses
• Rich Result objects (ValidEmail, InvalidEmail, SpoofEmail, MultipleErrors) with specific typed warnings (e.g. IPV6Deprecated, TLD, ObsoleteDTEXT) rather than a boolean pass/fail
• First-class MIME Message-ID validation via a dedicated MessageIDParser

Common Use Cases

• Validating user-submitted email addresses at signup or checkout with proper RFC compliance instead of an oversimplified regex
• Verifying a domain actually has DNS MX records before accepting an email address as deliverable
• Detecting spoofed or homograph-attack email addresses in security-sensitive registration flows
• Validating Message-ID headers when parsing or generating email/MIME content

Under The Hood

Architecture - The library implements a proper lexer (src/EmailLexer.php) and a set of composable parsers (src/Parser/LocalPart.php, DomainPart.php, DomainLiteral.php, Comment.php, etc.) that walk email address tokens according to RFC grammar rules, coordinated by src/EmailParser.php and exposed through the top-level EmailValidator class; validation behavior is pluggable via the strategy pattern (src/Validation/RFCValidation.php, DNSCheckValidation.php, MultipleValidationWithAnd.php), and outcomes are returned as typed Result objects (src/Result/) carrying structured warnings rather than a simple boolean.

Tech Stack - PHP 8.1+ using doctrine/lexer as the tokenizing foundation and symfony/polyfill-intl-idn for internationalized domain name handling; DNS validation uses PHP’s built-in DNS functions, and spoof-checking is gated behind the optional ext-intl extension; static analysis is enforced via Psalm (psalm.xml) and tests run on PHPUnit ^10.2.

Code Quality - The tests/ directory contains a substantial suite of PHPUnit tests exercising the lexer, parser, and each validation strategy independently, and the project enforces Psalm static analysis in CI, which is a meaningfully higher bar than most validation libraries; with 80 contributors and adoption as a core dependency of Symfony’s validator component, the codebase has had extensive real-world scrutiny.

API Design - The primary entry point (EmailValidator::isValid($email, $validationStrategy)) accepts an injectable validation strategy object, letting callers compose exactly the RFC strictness and DNS/spoof checks they need via MultipleValidationWithAnd, and typed warning objects on the Result give callers structured detail (e.g. ‘TLD looks fake’, ‘IPv6 address deprecated’) instead of an opaque failure.