MX record verification performed on ingest

Regex-only email validation lets addresses with non-existent domains into your database — contacts that will hard-bounce on every send, dragging down your sender reputation and triggering ISP throttling. CWE-20 (Improper Input Validation) applies directly: accepting structurally plausible but deliverability-dead addresses is a data integrity failure that accumulates silently. A domain with no MX record cannot receive mail; sending to it raises your bounce rate above the 2% threshold that ESP providers use to flag accounts for review or suspension. The cost is real: recovery from a suspended sender account typically requires list pruning, a warm-up period, and manual outreach to the ESP — days of lost campaign throughput.

Add MX verification to every email ingest path before the address is persisted. The Node.js built-in dns/promises module requires no extra dependencies:

import dns from 'dns/promises'

async function hasValidMx(email: string): Promise<boolean> {
  const domain = email.split('@')[1]
  if (!domain) return false
  try {
    const records = await dns.resolveMx(domain)
    return records.length > 0
  } catch {
    return false  // NXDOMAIN or SERVFAIL
  }
}

// Reject before storage:
if (!(await hasValidMx(email))) {
  return res.status(422).json({ error: 'Email domain cannot receive mail' })
}

Cache results per domain with a 6-hour TTL (see ab-000857) to avoid redundant DNS round-trips on repeated submissions.