How-to guide

How to Validate an Email Address

Syntax validation can prove an address is malformed but never that it exists. Keep the check deliberately loose — one at sign, something before it, a dot-containing domain after it — because strict patterns reject valid addresses such as those with plus tags or apostrophes. The only genuine verification is sending a message and having someone act on it.

Email Address Validator

Check a list of email addresses for syntax errors.

Open the tool

The specification permits far more than people expect: quoted local parts containing spaces, comments in brackets, and apostrophes in ordinary surnames. A regex written to match the full grammar is several hundred characters long and still cannot tell you whether the mailbox exists.

That gap matters commercially. A too-strict pattern silently rejects real customers, and the failure is invisible because the person simply leaves. A loose check that accepts a few malformed addresses costs far less than one that turns away valid ones.

Step by step

Check the shape, not the grammar
Require exactly one at sign, at least one character before it, and a domain after it containing a dot. That catches genuine typing errors such as a missing at sign without excluding anything legitimate.
Accept the characters people actually have
Plus tags, dots, hyphens and apostrophes all appear in real addresses. O'Brien and user+newsletter@example.com are both valid, and patterns that reject them are a recurring source of complaints.
Normalise before storing, not before validating
Trim whitespace and lowercase the domain, which is case-insensitive. Do not lowercase the local part: it is technically case-sensitive, even though most providers ignore that in practice.
Check the domain has a mail route
An MX lookup on the domain proves someone has configured mail there, which catches typos such as gmial.com. It says nothing about the specific mailbox, and it does require a network call, so treat it as an optional extra rather than part of form validation.
Send a confirmation to verify
A message with a unique link is the only check that proves the address exists and reaches the person who entered it. Everything before this step is a convenience for the user, not evidence for you.

Example

All four of these are valid addresses that over-strict patterns commonly reject.

Valid but often rejected

user+tag@example.com
o'brien@example.co.uk
firstname.lastname@sub.example.museum
user@example.travel

Genuinely malformed

user@@example.com
user@example
plain-text-no-at-sign

Frequently asked questions

What is the correct regex for an email address?

There is no practical one. The full specification allows quoted strings, comments and nested constructs, so a fully compliant pattern is hundreds of characters and still cannot confirm delivery. A loose shape check plus a confirmation email is the standard approach.

Are plus signs valid in email addresses?

Yes. user+tag@example.com is valid and widely used to label incoming mail. Rejecting it is one of the most common validation bugs, and it tends to annoy exactly the technically literate users you least want to lose.

Can an email address contain an apostrophe?

Yes, and it appears in real surnames such as O'Brien. It also needs care further down the stack, since an unescaped apostrophe in a query is a SQL injection vector — but the fix is parameterised queries, not rejecting the address.

Does an MX record prove the address works?

No. It proves the domain accepts mail somewhere, which rules out misspelt domains. The individual mailbox may still not exist, and many servers deliberately accept mail for unknown recipients rather than reveal which addresses are valid.

Should I lowercase the whole address?

Only the domain, which is case-insensitive by definition. The local part is technically case-sensitive, so lowercasing it changes the address. In practice nearly every provider treats it as insensitive, but storing what the user typed is safer.

Tools used in this guide

All tools →

All guides →

Last reviewed 28 August 2026.