Introduction

The maximum length of a valid email address is 254 characters. This limit comes from RFC 5321 (the SMTP specification) and applies to the complete local@domain string. The local part (before the @) can be at most 64 characters, and the domain part (after the @) can be at most 253 characters.

local-part@domain-part
  (max 64)   (max 253)
Total maximum: 254 characters

Note the total is 254, not 320 (64 + 1 + 255). The effective limit is constrained by how email addresses are encoded in SMTP commands. This article explains why, covers the relevant RFCs, and provides practical guidance for implementing email validation in your applications.

The Length Limits Explained

Why 254, Not 320?

A common mistake is to calculate 64 (local) + 1 (@) + 255 (domain) = 320. The actual limit of 254 comes from RFC 5321 Section 4.5.3.1, which defines the maximum length of a MAIL FROM or RCPT TO command path.

In SMTP, the email address is transmitted as part of a path enclosed in angle brackets:

RCPT TO:<[email protected]>

The maximum path length is 256 characters, which includes the enclosing < and >. So the address itself can be at most 256 - 2 = 254 characters.

This was formally clarified by Dominic Sayers (based on work by RFC author John Klensin) and is the universally accepted maximum.

Component Breakdown

Why the Domain Is 253, Not 255

RFC 1035 states that domain names can be 255 octets in wire format. The wire format includes a length byte at the start and a null terminator at the end, which leaves 253 characters for the actual domain name as a text string. This 253-character limit applies to the fully qualified domain name (FQDN) including all labels and dots.

What Characters Are Allowed?

Local Part Rules

The local part (before @) follows rules from RFC 5321 and RFC 5322:

1Allowed without quoting:
2  Letters:        A-Z, a-z
3  Digits:         0-9
4  Special chars:  ! # $ % & ' * + - / = ? ^ _ ` { | } ~
5  Dot:            . (but not first, last, or consecutive)

With quoting (enclosing the entire local part in double quotes), almost any character is valid, including spaces and @:

"unusual@address"@example.com    -- valid (quoted local part)
"spaces allowed"@example.com     -- valid

In practice, most email providers restrict local parts to letters, digits, dots, hyphens, and underscores.

Domain Part Rules

The domain part follows DNS naming rules:

1Labels:    Letters, digits, hyphens
2           Cannot start or end with a hyphen
3           Each label max 63 characters
4Separator: . (dot between labels)
5Total:     Max 253 characters

Example of a near-maximum domain:

a-very-long-subdomain.another-subdomain.yet-another.example.com

Validation in Code

JavaScript

1function validateEmailLength(email) {
2  if (email.length > 254) {
3    return { valid: false, reason: 'Email exceeds 254 character limit' };
4  }
5
6  const [local, ...domainParts] = email.split('@');
7  const domain = domainParts.join('@'); // Handle quoted @ in local part
8
9  if (!local || !domain) {
10    return { valid: false, reason: 'Missing local or domain part' };
11  }
12
13  if (local.length > 64) {
14    return { valid: false, reason: 'Local part exceeds 64 character limit' };
15  }
16
17  if (domain.length > 253) {
18    return { valid: false, reason: 'Domain part exceeds 253 character limit' };
19  }
20
21  // Check individual domain labels
22  const labels = domain.split('.');
23  for (const label of labels) {
24    if (label.length > 63) {
25      return { valid: false, reason: `Domain label "${label}" exceeds 63 character limit` };
26    }
27  }
28
29  return { valid: true };
30}

Python

1def validate_email_length(email: str) -> tuple[bool, str]:
2    if len(email) > 254:
3        return False, "Email exceeds 254 character limit"
4
5    if "@" not in email:
6        return False, "Missing @ separator"
7
8    local, domain = email.rsplit("@", 1)
9
10    if len(local) > 64:
11        return False, "Local part exceeds 64 character limit"
12
13    if len(domain) > 253:
14        return False, "Domain part exceeds 253 character limit"
15
16    labels = domain.split(".")
17    for label in labels:
18        if len(label) > 63:
19            return False, f"Domain label '{label}' exceeds 63 character limit"
20        if label.startswith("-") or label.endswith("-"):
21            return False, f"Domain label '{label}' cannot start or end with hyphen"
22
23    return True, "Valid"

Database Column Sizing

When designing database schemas for email storage, the column size should accommodate the maximum valid length:

1-- PostgreSQL / MySQL
2CREATE TABLE users (
3    id          SERIAL PRIMARY KEY,
4    email       VARCHAR(254) NOT NULL UNIQUE,
5    created_at  TIMESTAMP DEFAULT CURRENT_TIMESTAMP
6);

Using VARCHAR(254) is the most precise choice. It enforces the spec at the storage layer and communicates intent to other developers reading the schema.

Real-World Provider Limits

While the RFC allows 254 characters, major email providers impose stricter limits:

These are creation limits. Users cannot create addresses longer than these limits. However, addresses from custom domains routed through these providers may have longer local parts.

Input Field and API Validation

On the client side, use HTML's built-in length constraint:

<input type="email" name="email" maxlength="254" required />

On the server side, validate length before performing more expensive operations like DNS lookups:

1from pydantic import BaseModel, EmailStr, field_validator
2
3class UserCreate(BaseModel):
4    email: EmailStr
5
6    @field_validator("email")
7    @classmethod
8    def validate_email_length(cls, v):
9        if len(v) > 254:
10            raise ValueError("Email address exceeds maximum length of 254 characters")
11        return v.lower()

Always validate on both sides. Client-side constraints can be bypassed.

Common Pitfalls

Using 320 as the maximum length. The 64 + 1 + 255 = 320 calculation ignores the SMTP path encoding constraint. The correct maximum is 254. Using 320 is not harmful (it accepts all valid addresses), but it also accepts invalid ones and misrepresents the spec.

Rejecting valid addresses with strict regex. Many email regexes in the wild reject valid addresses like [email protected], "quoted string"@domain.com, or addresses with long domain parts. If you must use regex, keep it simple and rely on length checks and the presence of @ for basic validation. Full RFC compliance in regex is notoriously difficult.

Truncating on insert without validation. If your database column is VARCHAR(100) and you insert a 120-character email without checking length first, the database will either truncate it silently (MySQL in non-strict mode) or reject it with an error. Validate before inserting.

Treating the 64-character local part limit as universal. While the RFC allows 64 characters, most providers limit local parts to 30-40 characters. For user-facing forms, consider warning (but not blocking) when local parts exceed 40 characters, as these are rare in practice.

Not normalizing before length checks. Some inputs include leading/trailing whitespace. Trim the input before measuring length, or you may reject valid addresses and accept invalid ones:

email = raw_input.strip().lower()
if len(email) > 254:
    raise ValueError("Email too long")

Summary

• The maximum length of a valid email address is 254 characters (RFC 5321).
• The local part (before @) can be at most 64 characters.
• The domain part (after @) can be at most 253 characters.
• The 254 limit comes from SMTP path encoding (256 max path minus < and >).
• Use VARCHAR(254) in database schemas for email columns.
• Validate length on both client and server. Do not rely solely on regex.
• Real-world providers impose stricter limits than the RFC, typically 30-64 characters for the local part.
• Internationalized email addresses (RFC 6531) follow the same length limits but use UTF-8 encoding.