Regex for Email Validation: A Complete Guide

Email validation is the most frequently copied regex on the internet, and most of the copies are wrong in the same way: they reject valid addresses that real people actually use. Before you paste a pattern into a signup form, it is worth understanding what a regex can and cannot do here, because the failure mode is silent. A rejected customer gets an error message and leaves.

The only authoritative check is delivery

An address is valid if a message sent to it arrives. No regular expression can determine that, because deliverability depends on DNS records, mailbox existence and server policy. Everything a regex does is catch obvious typos and malformed input before you send a verification email. Treat it as a filter, not as validation.

What a practical pattern should check

1. Exactly one at sign, with at least one character on each side.
2. At least one dot in the domain, and no dot immediately before or after the at sign.
3. No spaces, and no characters that are outright illegal in an address such as angle brackets or a comma outside a quoted section.
4. A top-level domain of at least two letters, which rejects most accidental inputs such as name@company.
5. A sensible overall length limit. The full address may not exceed 254 characters in practice.

Cases that break naive patterns

• Plus addressing: [email protected] is valid and widely used for filtering.
• Dots inside the local part: [email protected], and even consecutive dots in some providers, though that is rare and provider-specific.
• Subdomains: [email protected] is a perfectly ordinary address.
• Long new top-level domains: [email protected] and similar are valid, so do not hard-code a list of two-letter endings.
• Uppercase letters and internationalised domains. Both are legal; normalise case rather than rejecting it.

How to test a pattern properly

Build a three-column test set before you ship anything. Column one contains addresses that must match, including the awkward ones above. Column two contains addresses that must be rejected: missing at sign, double at signs, trailing dot, spaces, empty local part, missing top-level domain. Column three contains inputs that look like addresses but are not, such as a full sentence, a phone number or a URL. Run all three columns. A pattern that passes column one but also matches half of column three will cause more damage than no validation at all.

What to do after the regex passes

• Normalise the domain to lowercase and trim surrounding whitespace before storing.
• Send a verification link with a short expiry, and do not mark the account as confirmed until it is clicked.
• Apply rate limits to the verification endpoint, or it becomes a free way to send mail through your domain.
• Show a specific error message. "Please enter a valid email address" tells the user nothing about which part is wrong.