Every signup form has one. Most of them are wrong in both directions: they reject addresses that are perfectly legal and accept addresses that go nowhere.
The rejection side is the more embarrassing failure. Plus addressing is legal and widely used, and a form that rejects user+tag@example.com is turning away someone who knows more about email than whoever wrote the pattern. Apostrophes are legal, so o'brien@example.com is a valid address that many forms refuse. Newer top-level domains break patterns that assumed two to four letters at the end.
The acceptance side is quieter and more expensive. asdf@asdf.com matches any regex you can write. So does a correctly formed address at a domain with no MX records, and a perfectly shaped local part at a real company where nobody by that name has ever worked.
The specification that governs address syntax permits quoted strings, comments and characters almost nobody uses. A regex that implements it completely is famously about six thousand characters long, and it still only proves the string is well formed.
What to do at the form instead
Use a deliberately loose pattern: something before an @, something after it, a dot in the domain. Its job is catching a fat-fingered paste, not enforcing the specification.
Check the domain has MX records. That is a DNS lookup and it eliminates typo domains like gmial.com, which is a large share of real-world signup errors.
Do a real-time check where the stakes justify it, with a short timeout, and never block a registration because a server would not answer. Accept and flag instead.
Suggest corrections rather than rejecting. Someone who typed gmial.com will fix it if you ask, and will leave if you tell them their address is invalid.
Where this argument costs us something
The short version
- Keep the pattern loose and let DNS and SMTP do the real work.
- Never reject a legal address because your pattern is stricter than the specification.
- Suggest a correction for a likely typo domain instead of refusing the signup.
Questions people ask
Is there a correct regex for email addresses?
One that implements the specification completely exists and is thousands of characters long. It still only proves the string is well formed, which is the part that was never the problem.
Should a signup form block an address that fails verification?
No. Accept it and flag it. An address we could not resolve is frequently a working mailbox at a server that refused our probe, and blocking that registration costs you a customer over somebody else's policy.