Introduction

Checking whether an email address is "valid" can mean several different things. It might mean the string has a reasonable email shape, the domain exists, or the user actually controls that mailbox and can receive mail.

Those are different levels of validation, and they should not be confused. A regex can check syntax-like structure, but it cannot prove the mailbox exists or that the user owns it.

Decide What "Valid" Means

In most applications, the practical validation stack looks like this:

1. basic format check
2. optional domain-level validation
3. actual ownership check with a verification email

That third step is the only reliable proof that the address is usable by the person who entered it.

A Reasonable Basic Format Check

For lightweight validation, a simple regular expression is usually enough. The goal is not to implement the full email RFC grammar. The goal is to reject obvious mistakes such as missing @ signs or spaces.

1import re
2
3EMAIL_RE = re.compile(r"^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$")
4
5def looks_like_email(value: str) -> bool:
6    return bool(EMAIL_RE.fullmatch(value))
7
8
9tests = [
10    "[email protected]",
11    "bad [email protected]",
12    "missing-at-sign.example.com",
13    "no-tld@example",
14]
15
16for item in tests:
17    print(item, looks_like_email(item))

This is intentionally modest. It catches common user-input mistakes without pretending to be a complete RFC parser.

Better Validation with a Library

If you want stronger validation in Python, use a dedicated library instead of writing a giant regex. The email-validator package is a common choice because it normalizes addresses and performs useful checks.

pip install email-validator

Example:

1from email_validator import EmailNotValidError, validate_email
2
3def validate_user_email(raw_email: str) -> str | None:
4    try:
5        result = validate_email(raw_email, check_deliverability=False)
6        return result.normalized
7    except EmailNotValidError:
8        return None
9
10
11print(validate_user_email("[email protected]"))

This gives you stronger parsing behavior and normalized output without re-implementing mail syntax rules yourself.

Domain Checks and Deliverability

Some validation libraries can also check whether the domain has usable mail records. That is stronger than a regex, but it still does not prove the individual mailbox exists.

For example:

1from email_validator import EmailNotValidError, validate_email
2
3try:
4    result = validate_email("[email protected]", check_deliverability=True)
5    print(result.normalized)
6except EmailNotValidError as exc:
7    print(f"Invalid: {exc}")

This can catch clearly non-deliverable domains, but it depends on DNS and network availability, so many applications reserve it for later steps or background checks.

Verification Email Is the Real Test

If the application actually needs a working mailbox, send a verification email with a time-limited token.

Example workflow:

1import secrets
2
3def generate_verification_token() -> str:
4    return secrets.token_urlsafe(32)
5
6
7token = generate_verification_token()
8print(token)

The app stores the token, emails a link to the user, and marks the address as verified only after the link is clicked. That confirms ownership in a way that syntax validation never can.

What Not to Do

Avoid trying to fully validate every RFC edge case with a hand-written regex. Email syntax is broader than most people expect, and a "perfect" regex usually becomes unreadable while still missing real-world concerns.

Also avoid SMTP probing as a sign-up-time check. Many mail servers block or mislead those probes, and the approach creates latency, privacy issues, and deliverability risks.

Common Pitfalls

The biggest pitfall is treating regex validation as proof that the email address exists. It only proves that the string looks plausible.

Another mistake is using an overly strict regex that rejects real addresses users legitimately own. Real systems should optimize for practical correctness, not theoretical regex cleverness.

Developers also sometimes skip normalization. Case sensitivity rules are subtle, but normalizing whitespace, Unicode handling, and domain casing usually improves consistency.

Finally, do not conflate domain existence with user ownership. A domain with valid mail records still does not prove the mailbox is real or controlled by the current user.

Summary

• "Valid email" can mean syntax, domain deliverability, or actual mailbox ownership.
• A simple regex is fine for basic input screening.
• A dedicated validation library is better than a hand-written giant regex.
• Domain checks are stronger than syntax checks but still not proof of ownership.
• Verification email is the most reliable confirmation that the address can actually be used.
• Choose the level of validation that matches the business requirement instead of over-validating everything at input time.