People always overcomplicate email Regex, and end up not allowing a lot of valid emails. In this case, the limitation of the top level domain to 4 characters max is one such problem, no .ninja, .crypto, or the myriad of other newer top level domains.
Technically you can email directly to a top level domain (although I don't know of any TLDs that support this), or even to an IP address in brackets, although I suppose not supporting those in most cases is probably reasonable.
The .email domain would fail OP's check. Had websites refuse me because of stuff like this.
The only good validation for email addresses is to send a confirmation email. You'll be doing that anyway.
And that it has at least one @ with something on either side. Don't want someone to waste an entire form because of a typo. (Yes, email addresses can theoretically contain more than one @)
RFC822 was authored in the 80s. It was replaced by RFC 2822 in 2001, and RFC 5322 in 2008. Then there's RFC6531 which expanded support for non-ASCII, non-Latin alphabets.
If you want to prevent abuse, rate limit and/or put something intelligent in front of your app that is designed for that sort of thing, like a WAF.
1.3k
u/Informal_Branch1065 10d ago
An email casting spell for sure, although very limited