# Consequences of not validating email addresses
**URL:** https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132
**Category:** Support
**Created:** [2016年二月25日 00:04 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132 "2016-02-25T00:04:10Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [2016年二月25日 00:04 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132/1 "2016-02-25T00:04:11Z")
I’m using Discourse with SSO. The guidelines say:
> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> ⚠ Discourse uses emails to map external users to Discourse users, and assumes that external emails are secure. IF YOU DO NOT VALIDATE EMAIL ADDRESSES BEFORE SENDING THEM TO DISCOURSE, YOUR SITE WILL BE EXTREMELY VULNERABLE!
>
> Alternatively, if you insist on sending unvalidated emails BE SURE to set require\_activation=true, this will force all emails to be validated by Discourse.
I’m tempted to 🔥 open the gates of hell 🔥 and not send `require_activation=true` although I’m not validating addresses. There are good reasons why I cannot force email address validation in my SSO provider, and I’d really like my users to have a fully set-up Discourse account with a single click.
What terrible consequences will this have?
- Users can sign up with a developer email address and become admins.
**Solution:** All developer addresses are taken already.
- I make spam sign-ups easier.
**Solution:** Registration on the parent site is only open for a limited amout of time and to a limited set of people.
- If I ever disable SSO, password recovery mails go to the wrong address.
**Solution:** I will never disable SSO. Instead, the Discourse instance will be 💣 when it is no longer needed.
- Users can sign up with addresses they do not own and spam the owner of the address.
**Workaround:** Not a new problem, they can already do that on the parent site. It has never been a problem.
- Users can sign up with incorrect addresses accidentally and miss important emails.
**Workaround:** Missing emails from the parent site is probably the bigger problem for these users 😉
I know that I’m leaving the safe, established path if I go ahead. Still, does anyone see a significant problem with this?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016年二月25日 00:12 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132/2 "2016-02-25T00:12:50Z")
I would strongly recommend against it, but it sounds like you are hell bent on doing so.. 😷
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [2016年二月25日 14:32 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132/3 "2016-02-25T14:32:20Z")
> [@codinghorror](#):
>
> but it sounds like you are hell bent on doing so
Not really – I’m totally willing to stick to validating addresses if there’s a risk I didn’t see before 🙂
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [2016年二月25日 14:56 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132/4 "2016-02-25T14:56:16Z")
An additional consequence:
- Will reduce outgoing mail server’s reputation to fall and possibly become blacklisted.
- Sending mail to invalid email addresses or to addresses where mail is marked as spam or large amount of mail goes unopened will cause mail server reputation to fall.
- Mail server IPs or entire IP ranges may be blacklisted for a short or extended period.
- Mail to valid users may be filtered and flagged as spam or not delivered.
- Discourse is setup as default to: send digests and reply emails if the user is not on the site.
- Users may optionally set “mailing list mode” causing lots of emails to be sent to the users mailing address.
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [2016年二月25日 15:01 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132/5 "2016-02-25T15:01:40Z")
That’s also a good point!
I think it should not be a problem in my case, given the limitations on sign-ups.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [2018年十二月22日 18:09 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132/6 "2018-12-22T18:09:07Z")
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [2018年十二月23日 02:14 UTC](https://meta.discourse.org/t/consequences-of-not-validating-email-addresses/40132/7 "2018-12-23T02:14:41Z")