Why a regex is not enough for email validation
A regular expression can check the shape of an address, and that is all. Here is what it misses, and what to do instead.
Photo by Pexels on Pixabay
Almost every developer has written, copied or argued about an email regex. It feels like the obvious solution. It is a fine first step, and a poor last one.
What a regex can do
It checks the shape of the string: some characters, an @, some more characters, a dot, a few letters. That catches bob, bob@, @example.com and bob@@example.com.
What it can't do
It can't tell whether the domain exists. bob@exmaple.com matches every regex ever written.
It can't spot typos. bob@gmial.com is a perfect-looking address.
It can't see disposable domains or role accounts.
It can't check the mailbox. Whether bob exists is a question for the mail server.
And regexes are hard to get right
The official address grammar is more permissive than most people expect. Quoted local parts, comments and unusual characters are technically allowed, and a "simple" regex either rejects real addresses or accepts nonsense. Some patterns also suffer from catastrophic backtracking, where a crafted input makes the regex take enormous time and hangs your server.
International addresses make it harder: domains can contain non-Latin characters and need conversion to their ASCII (punycode) form before lookup.
Practical addresses are mostly well behaved. Mailsure accepts the conventional dot-atom form, lowercases the domain and handles international domain names. It is deliberately stricter than the full standard on exotic forms (quoted strings and the like), because nobody uses them in practice and rejecting them rarely hurts a real person.
A sensible approach
- Do a light check in the browser. Use the built-in
type="email"input, which gives instant feedback on obvious mistakes, and don't make it stricter than that. - Verify on the server. Send the address to a verification API (example) and act on the result.
- Confirm ownership when it matters with a link in a confirmation email.
The one rule
Never reject a real customer because your regex was too clever. A false rejection costs you a signup; a false acceptance costs you one bounce. When in doubt, be lenient at the format stage and let verification do the real work.
Compare the two layers in validation vs verification.
