Thread by @jschauma

Look, your email validation logic is very, very likely wrong.

A few examples:

Email addresses can contain multiple '@'s.

Well, SMTP "RCPT TO" anyway, where this is valid:

@1st.relay,@2nd.relay:[e-mail]

MTAs generally don't relay them any more, but most seem to accept and deliver to [e-mail].

Bang paths may be accepted.

No, not what you think, you pig. UUCP. This is valid:

relay.domain!user@domain

Your MTA will probably reject this as an attempt to relay, but, hey, it's valid, although RFC5321 does not tell you to treat "!" special.

Likewise, you can try to relay via the "%-hack":

[e-mail]

Try it out and see if your MTA will try to deliver to "final.domain" or "1st.relay"...

Hey, about that "!" and "%"... they are not special. RFC5321 allows all sorts of punctuation. For example, this is a valid email address:

'*+-/=?^_`{|}~#$@netmeister.org

(Though I don't know what Twitter turns this into.)

Plus signs aren't special, except when they are.

Gmail and Outlook decided to use "plus addressing" and deliver all of these to the same mailbox:

jdoe@domain
jdoe+whatever@domain
jdoe+somethingelse@domain

But nobody said you have to.

Dots, however, _are_ special.

Gmail ignores them, so "[e-mail]" and "[e-mail]" end up in the same mailbox, but there's no reasin that has to be the case.

However, you can't start or end a local part with a "." or have multiple consecutive dots.

Unless, of course, you quote 'em.

Which makes the following all valid:

".jdoe"@domain
"jdoe."@domain
"jd..oe@domain"

Oh, hey, if we can quote things, then we can do all sorts of other shenanigans, and call these valid, too:

" "@netmeister.org
"<>"@netmeister.org
"put a literal escaped newline here\^M <--"@domain

The local part is case-sensitive.

These two are _different_ mailboxes:

[e-mail]
[e-mail]

If your MTA supports SMTPUTF8, you can put non-Latin characters in the local part:

"josé.arrañoça"@domain
"сайт"@domain
"💩"@domain
"🍺🕺🎉"@domain

Your local part is limited to 64 octets (but the forward path allows for 256). These two are valid:

~@domain
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~@domain

The domain name does not need to resolve on the internet.

Use SMTP as a hidden service and use a .onion address, like:
[e-mail]

Hey, we now have internationalized domain names, so the following are valid:

[e-mail]
poop@💩.la
"🌮"@i❤️.ws
jschauma@شبكةمايستر..شبكة

Who needs a domain name at all when you can instead use an IP address literal? These are valid:

jschauma@[166.84.7.99]
jschauma@[IPv6:2001:470:30:84:e276:63ff:fe72:3900]
jschauma@[IPv6:::1]
"[IPv6:::1]"@[IPv6:::1]

Ok, so not all of these will be accepted by all mail servers, but according to the RFCs, they are all valid.

So your initial regex of (?<username>[a-z0-9.-]+)@(?<domain>[a-z0-9.-]+\.[a-z0-9]+) is, I'm afraid, not going to cut it.

This thread as single blog post (with just a little bit more detail):

netmeister.org/blog/email.html

If you have corrections, email me at ^_^@netmeister.org.