feat: check MX records against prohibited domains

[miketheman]

Using the email-validator package, which is already part of wtforms's dependencies, check if the domain is actually deliverable prior to accepting the address.

Deliverability check produces the MX records in the response.
Use them to check against the Prohibited Domains lists.

Resolves: #16136

[ewdurbin]

I'm worried that this is going to have unintended side effects in combination with #16586.

For instance:

$ dig microsoft.com MX +short
10 microsoft-com.mail.protection.outlook.com.

And we have outlook.comon our prohibited domains list, which I think means we will bar @microsoft.com and other domains with outlook hosted mail from registering?

[ewdurbin]

Yeah, it seems applying:

diff --git a/tests/unit/manage/test_forms.py b/tests/unit/manage/test_forms.py
index 6250fbb6e..22bfd934d 100644
--- a/tests/unit/manage/test_forms.py
+++ b/tests/unit/manage/test_forms.py
@@ -247,7 +247,7 @@ class TestAddEmailForm:
 
         Simulate that `mail.net` handles emails sent to `wutang.net`.
         """
-        mock_deliverability_info = {"mx": [(10, "mail.net")]}
+        mock_deliverability_info = {"mx": [(10, "microsoft-com.mail.protection.outlook.com.")]}
 
         def mock_function(*args, **kwargs):
             return mock_deliverability_info
@@ -257,12 +257,12 @@ class TestAddEmailForm:
             mock_function,
         )
 
-        prohibited_mx_domain = ProhibitedEmailDomain(domain="mail.net")
+        prohibited_mx_domain = ProhibitedEmailDomain(domain="outlook.com")
         db_request.db.add(prohibited_mx_domain)
 
         form = forms.AddEmailForm(
             request=db_request,
-            formdata=MultiDict({"email": "foo@wutang.net"}),
+            formdata=MultiDict({"email": "foo@microsoft.com"}),
             user_service=pretend.stub(find_userid_by_email=lambda _: None),
             user_id=pretend.stub(),
         )

still passes test (aka blocks the address).

[miketheman]

Thanks for poking at it!
I think this is a use case that needs some more thought, so I'll convert to Draft for now.