How to detect if an email is a Google Account?

Question

Me and some guys here are working on an start up. We are currently using Google OpenID API to manage registration and login to our app, but we want to migrate to a easier user registration model. And for this, we need to know if there is a way we can detect if an email (not gmail) is already a Google Account. Is there a way to get this info from the Google Single Sign-on API?

Previous thanks for your help! :)

Solution 1

You cannot do that. I don't think Google could tell you that without user consent.

You could, however, see if the domain is a a Google Apps domain by use this as the Discovery URL: https://www.google.com/accounts/o8/site-xrds?hd=mail.moztw.org

Noted that the admin of the domain might not properly installed OpenID support for the domain. My slide have discussed this in detail: http://www.slideshare.net/timdream/google-apps-account-as-openid

Solution 2

If you're on a Mac, open Terminal and enter $ host {example.com} to determine if their email is hosted by Google.

For example:

$ host yelp.com
yelp.com has address 104.16.57.23
yelp.com has address 104.16.56.23
yelp.com mail is handled by 1 ASPMX.L.GOOGLE.com.
yelp.com mail is handled by 10 ASPMX2.GOOGLEMAIL.com.
yelp.com mail is handled by 10 ASPMX5.GOOGLEMAIL.com.
yelp.com mail is handled by 10 ASPMX3.GOOGLEMAIL.com.
yelp.com mail is handled by 5 ALT2.ASPMX.L.GOOGLE.com.
yelp.com mail is handled by 10 ASPMX4.GOOGLEMAIL.com.
yelp.com mail is handled by 5 ALT1.ASPMX.L.GOOGLE.com.

Solution 3

This isn't a complete solution, but you can tell if someone is on Google Apps by looking at their domain's MX records. The link in the answer didn't work for me, so that may be a better solution.

Solution 4

You can check the Identity Provider with a google api https://dns.google.com/resolve?name=example.com&type=MX

    public static class IdentityProviderChecker
    {
        public static async Task<string?> GetProviderName(string email)
        {
            var domainName = email.Split('@').Last();
            using var client = new HttpClient();

            var result = await client.GetAsyncResult<DnsResponse>($"https://dns.google.com/resolve?name={domainName}&type=MX");
            return result.Answer.Any(x => x.Data.Contains("google.com", StringComparison.OrdinalIgnoreCase) || x.Data.Contains("googlemail.com", StringComparison.OrdinalIgnoreCase))
                ? "Google"
                : result.Answer.Any(x => x.Data.Contains("outlook.com", StringComparison.OrdinalIgnoreCase))
                    ? "Microsoft"
                    : null;
        }
    }

    public class DnsResponse
    {
        public Answer[] Answer { get; set; } = null!;
    }

    public class Answer
    {
        public string Data { get; set; } = null!;
    }

Solution 5

I worked out Doug's suggestion and it works. Just make sure that the (effective) user invoking the function has the right to call addViewer. A trick to accomplish this is to make sure the routine is called from a trigger routine, so the owner of the script is the effective user.

function checkIfGoogleAccount(emailAddress) {
  try {
    SpreadsheetApp.getActiveSpreadsheet().addViewer(emailAddress) ;
    SpreadsheetApp.getActiveSpreadsheet().removeViewer(emailAddress) ;
    return true ;
  }
  catch(err) {
    return false ;
  }
}

View more solutions

Comments

[FernandoEscher]

Thanks for the response. Of course it cannot be done, starting from the point that the OpenID protocol doesn't provide any support for user interaction said it all. Indeed we are already using hosted domains detection. Thanks for the advice! :)

[Rishabh]

the link wont work if you open in a browser .. do a curl call and check for the header status

[Samin]

in PHP, use getmxrr and match the results against google. Example gist.github.com/samin/f89c0f9b67ae82200e22

[rdb]

I suggest you don't do this. Just because an e-mail address is under a G-Suite domain doesn't necessarily mean that person has a Google account. There are unfortunately G-Suite domains out there where this is not the case, ie. where some of the e-mail addresses are simply forwarders.

[timdream]

@rdb Yeah you are right, the answer only tell if the given domain is a GSuite domain, not the e-mail itself. OpenID is deprecated so I would take a grain of sand of the answer myself.

[shimatai]

Simple and sweet!

[Vali Shah]

Hi @FernandoEscher, even i have come across similar problem. Can you help me in achieving the solution. I mean how you are using hosted domains detection to solve the problem.

[Johann Medina]

Great solution !