Hello there,

Following a discussion at work, I looked into a package used for postal code validation (axlon/postal-code-validation), which is seeding data from the Google Address Data Service (as pointed out in axlon/postal-code-validation#27).

After a short discussion, @wotta pointed out that the regex used is invalid. The regex (\d{4} ?[A-Z]{2}) allows the following invalid postal codes:

• 0123 AB, which are invalid since all our postal codes start with 1-9.
• 1111 SA, 1111 SD and 1111 SS, which are banned due to the SA, SD, and SS abbreviations which were used in the Second World War ^source.

A better regex for Dutch postal codes would be [1-9]\d{3} ?(?!SA|SD|SS)[A-Z]{2}, which explicitly excludes zero-based postal codes and invalid suffixes.

I made some tests on regex101.com (click on "Unit Tests" in the left sidebar).