Validating email without a regex

An email address takes two steps: a loose regex stops typos, a confirmation message proves the mailbox exists. No regex on its own can tell whether the address is real.

What the standard says

The full syntax lives in RFC 5322, and the regex that covers it is long and unreadable. For a form, three checks are enough: one at sign, a non-empty local part and a domain with at least one dot.

function looksLikeEmail(value) {
  if (value.length > 254) return false;
  const at = value.indexOf("@");
  if (at < 1 || at !== value.lastIndexOf("@")) return false;
  const local = value.slice(0, at);
  const domain = value.slice(at + 1);
  return local.length <= 64 && /^[^\s@]+$/.test(local) && /^[^\s@]+\.[^\s@]+$/.test(domain);
}

The limits come from RFC 5321: 254 characters overall and 64 in the local part. They are transport limits, not proof that the address exists, so read them as a ceiling and not as a confirmation.

The three checks that suffice

• Spaces and double at signs: visible without a regex, and they cover most typos.
• Dot in the domain: a domain without a dot does not resolve, except on a local network.
• Length: past the limits some server downstream rejects the message, not the form.

Trying it in one command

node -e "const ok = (s) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s); console.log(ok('[email protected]'), ok('a@@b.co'), ok('a [email protected]'))"

The command prints true false false: the regex accepts the plausible address and rejects the double at sign and the space. Check those three cases before trusting the regex, because each covers a different mistake.

Live records in the catalogue

Three signup forms: full-screen-signup, auth-form and signup-01. To browse by category start from signup blocks.

The limitation

The regex accepts addresses no server delivers and rejects rare legal cases, such as a domain with non-Latin characters. The proof that matters is the link or the one-time code: until it is used, the address stays unverified.

Where to continue

Shared validation is in validation with Server Actions; the progressive form is in progressive form; the measured comparison of form libraries is in React form libraries.