Email verification in Rails

# app/validators/deliverable_email_validator.rb
class DeliverableEmailValidator < ActiveModel::EachValidator
  def validate_each(record, attribute, value)
    checked = ZapBounce.new.verify(value, timeout: 2)
    verdict = checked["result"]
    record.email_verdict = verdict if record.respond_to?(:email_verdict=)

    # catch_all and unknown both pass. Only a definite no is an error, plus the
    # disposable flag, which is a boolean beside the result.
    return unless verdict == "invalid" || checked["disposable"]

    record.errors.add(attribute, "will not receive mail. Check it for a typo.")
  rescue Net::ReadTimeout, Net::OpenTimeout, ApiError => e
    # Fail open, loudly in the log and silently to the user.
    Rails.logger.warn("zapbounce unavailable: #{e.message}")
    record.email_verdict = "unknown" if record.respond_to?(:email_verdict=)
  end
end

# app/models/user.rb
class User < ApplicationRecord
  validates :email, presence: true, deliverable_email: true, on: :create
end

# app/jobs/verify_contact_list_job.rb
class VerifyContactListJob < ApplicationJob
  queue_as :low
  retry_on ApiError, wait: :polynomially_longer, attempts: 3
  discard_on ActiveRecord::RecordNotFound

  def perform(list_id)
    list = ContactList.find(list_id)

    emails = list.contacts.where(verdict: nil).pluck(:email)
    return if emails.empty?

    batch_id = ZapBounce.new.submit_batch(
      emails,
      name: "list-#{list_id}",
      idempotency_key: "list-#{list_id}",
      webhook_url: Rails.application.routes.url_helpers.zapbounce_webhook_url,
    )

    list.update!(batch_id: batch_id)
    # No polling. WebhooksController picks it up on completion.
  end
end

# app/jobs/import_batch_results_job.rb
class ImportBatchResultsJob < ApplicationJob
  def perform(batch_id)
    ZapBounce.new.results(batch_id).each_slice(1000) do |rows|
      Contact.upsert_all(
        rows.map { |r| { email: r["email"], verdict: r["result"], updated_at: Time.current } },
        unique_by: :email,
      )
    end
  end
end

# app/controllers/webhooks_controller.rb
class WebhooksController < ActionController::API
  def zapbounce
    raw = request.raw_post          # the bytes, before params touched anything
    parts = request.headers["ZapBounce-Signature"].to_s
                   .split(",").map { |p| p.split("=", 2) }.to_h

    return head :unauthorized if (Time.now.to_i - parts["t"].to_i).abs > 300

    expected = OpenSSL::HMAC.hexdigest(
      "SHA256", Rails.application.credentials.zapbounce[:webhook_secret],
      "#{parts['t']}.#{raw}"
    )

    return head :unauthorized unless ActiveSupport::SecurityUtils
      .secure_compare(expected, parts["v1"].to_s)

    event = JSON.parse(raw)

    # Deliveries repeat. The unique index makes a replay a no-op.
    WebhookEvent.create!(id: event["id"], event_type: event["type"])
    ImportBatchResultsJob.perform_later(event.dig("data", "batch_id"))

    head :no_content
  rescue ActiveRecord::RecordNotUnique
    head :no_content              # already handled, and that is fine
  end
end

# config/routes.rb
post "/webhooks/zapbounce", to: "webhooks#zapbounce", as: :zapbounce_webhook