How to Validate an Email Address: What Actually Matters

The minimum viable email validation

For most applications, this is enough:

^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$

This checks that the address has:

1. A local part before the @ (letters, numbers, dots, underscores, percent, plus, hyphen)
2. An @ symbol
3. A domain name
4. A dot followed by at least 2 letters (TLD)

It will reject clearly invalid addresses and accept all common ones. It will also accept some technically invalid addresses — but that's the right trade-off, as we'll see.

Test this pattern immediately in the free regex tester.

What RFC 5322 actually allows (the problem)

The official email standard (RFC 5322) allows email addresses that look nothing like what most people expect:

• "john doe"@example.com — quoted local part with a space
• user+tag@example.com — plus addressing (common, works fine)
• user.@example.com — trailing dot in local part (technically valid)
• "very.unusual.@.unusual.com"@example.com — quoted with special chars
• user@[192.168.1.1] — IP address as domain

If you write a regex strict enough to reject all these edge cases, you'll also reject some legitimate addresses your users actually have. The consensus among email deliverability experts: validate leniently in the regex and validate strictly by sending a confirmation email.

The only real validation: send a confirmation email

Regex validation tells you if an email address is formatted plausibly. It can't tell you:

• Whether the mailbox exists
• Whether the person has access to it
• Whether the domain has working MX records
• Whether it's a disposable email (10-minute mail)

A confirmation email with a link is the only reliable way to verify that an email address is real and belongs to the person signing up. This is also why you should never block users from continuing past email validation — let them proceed, send the confirmation, and require clicking the link before giving full access.

MX record checking

One step beyond regex: verify that the email's domain has an MX (Mail Exchanger) DNS record — meaning it can receive email at all. Domains without MX records can't receive email.

Check DNS records (including MX) for any domain with the free DNS lookup tool. If a domain has no MX records, the email address is certainly undeliverable.

In code (Node.js):

const dns = require('dns').promises;
const hasMX = await dns.resolveMx('example.com')
  .then(records => records.length > 0)
  .catch(() => false);

Common validation mistakes to avoid

• Rejecting plus addressing. user+tag@gmail.com is valid and commonly used for filtering. Many strict regex patterns reject the + character — don't.
• Rejecting long TLDs. New TLDs like .photography, .academy, and .technology are up to 63 characters long. Any validation that limits TLD to 4 characters will reject these legitimate addresses.
• Rejecting international email. Email addresses can use internationalized domain names and, in some implementations, Unicode local parts. If your system handles international users, be careful with overly restrictive validation.
• Blocking disposable email services. Maintaining a blocklist of disposable email providers (Mailinator, Temp-Mail, etc.) is a valid anti-abuse measure — but it requires ongoing maintenance and will occasionally block legitimate users using privacy-focused email services.

Client-side vs server-side validation

Always validate on both:

• Client-side (HTML5 / JavaScript): Immediate feedback to the user before form submission. Use the HTML type="email" input, which provides built-in basic validation in modern browsers. Add JavaScript for custom error messages.
• Server-side: Never trust client-side validation alone — it can be bypassed. Re-validate the email format and perform MX checks on the server before storing or using the address.

HTML input with built-in email validation:

<input
  type="email"
  required
  placeholder="your@email.com"
  pattern="[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}"
/>

Related tools

• Free Regex Tester — test your email validation regex against real addresses
• Free DNS Lookup — check if a domain has MX records before sending

Written by Achraf A., founder of TheFreeAITools.