The regular expression for an email address is:
/^("(?:[!#-\[\]-\u{10FFFF}]|\\[\t -\u{10FFFF}])*"|[!#-'*+\-/-9=?A-Z\^-\u{10FFFF}](?:\.?[!#-'*+\-/-9=?A-Z\^-\u{10FFFF}])*)@([!#-'*+\-/-9=?A-Z\^-\u{10FFFF}](?:\.?[!#-'*+\-/-9=?A-Z\^-\u{10FFFF}])*|\[[!-Z\^-\u{10FFFF}]*\])$/u
This regular expression is 100% identical to the addr-spec
ABNF for non-obsolete email addresses, as specified across RFC 5321, RFC 5322, and RFC 6532.
Additionally, you must verify:
- The email address is well-formed UTF-8 (or ASCII, if you cannot send to internationalized email addresses)
- The address is not more than 320 UTF-8 bytes
- The user part (the first match group) is not more than 64 UTF-8 bytes
- The domain part (the second match group) is not more than 255 UTF-8 bytes
The easiest way to do all of this is to use an existing function. In PHP, see the filter_var function using FILTER_VALIDATE_EMAIL
and FILTER_FLAG_EMAIL_UNICODE
(if you can send to internationalized email addresses):
$email_valid = filter_var($email_input, FILTER_VALIDATE_EMAIL, FILTER_FLAG_EMAIL_UNICODE);
However, maybe you're building such a function—indeed the easiest way to implement this is to use a regular expression.
Remember, this only verifies that the email address will not cause a syntax error. The only way to verify that the address can receive email is to actually send an email.
Next, I will treat how you generate this regular expression.
I write a new answer, because most of the answers here make the mistake of either specifying a pattern that is too restrictive (and so have not aged well); or they present a regular expression that's actually matching a header for a MIME message, and not the email address itself.
It is entirely possible to make a regular expression from an ABNF, so long as there are no recursive parts.
RFC 5322 specifies what is legal to send in a MIME message; consider this the upper bound on what is a legal email address.
However, to follow this ABNF exactly would be a mistake: this pattern technically represents how you encode an email address in a MIME message, and allows strings not part of the email address, like folding whitespace and comments; and it includes support for obsolete forms that are not legal to generate (but that servers read for historical reasons). An email address does not include these.
RFC 5322 explains:
Both atom and dot-atom are interpreted as a single unit, comprising
the string of characters that make it up. Semantically, the optional
comments and FWS surrounding the rest of the characters are not part
of the atom; the atom is only the run of atext characters in an atom,
or the atext and "." characters in a dot-atom.
In some of the definitions, there will be non-terminals whose names
start with "obs-". These "obs-" elements refer to tokens defined in
the obsolete syntax in section 4. In all cases, these productions
are to be ignored for the purposes of generating legal Internet
messages and MUST NOT be used as part of such a message.
If you remove CFWS
, BWS
, and obs-*
rules from the addr-spec
in RFC 5322, and perform some optimization on the result (I used "greenery"), you can produce this regular expression, quoted with slashes and anchored (suitable for use in ECMAScript and compatible dialects, with added newline for clarity):
/^("(?:[!#-\[\]-~]|\\[\t -~])*"|[!#-'*+\-/-9=?A-Z\^-~](?:\.?[!#-'*+\-/-9=?A-Z\^-~])*)
@([!#-'*+\-/-9=?A-Z\^-~](?:\.?[!#-'*+\-/-9=?A-Z\^-~])*|\[[!-Z\^-~]*\])$/
This only supports ASCII email addresses. To support RFC 6532 Internationalized Email Addresses, replace the ~
character with \u{10FFFF}
(PHP, ECMAScript with the u
flag), or \uFFFF
(for UTF-16 implementations, like .NET and older ECMAScript/JavaScript):
/^("(?:[!#-\[\]-\u{10FFFF}]|\\[\t -\u{10FFFF}])*"|[!#-'*+\-/-9=?A-Z\^-\u{10FFFF}](?:\.?[!#-'*+\-/-9=?A-Z\^-\u{10FFFF}])*)@([!#-'*+\-/-9=?A-Z\^-\u{10FFFF}](?:\.?[!#-'*+\-/-9=?A-Z\^-\u{10FFFF}])*|\[[!-Z\^-\u{10FFFF}]*\])$/u
This works, because the ABNF we are using is not recursive, and so forms a non-recursive, regular grammar that can be converted into a regular expression.
It breaks down like so:
- The user part (before the
@
) may be a dot-atom or a quoted-string
"([!#-\[\]-~]|\\[\t -~])*"
specifies the quoted-string form of the user, e.g. "root@home"@example.com
. It permits any non-control character inside double quotes; except that spaces, tabs, double quotes, and backslashes must be backslash-escaped.
[!#-'*+\-/-9=?A-Z\^-~]
is the first character of the dot-atom of the user.
(\.?[!#-'*+\-/-9=?A-Z\^-~])*
matches the rest of the dot-atom, allowing dots (except after another dot, or as the final character).
@
denotes the domain.
- The domain part may be a dot-atom or a domain-literal.
[!#-'*+\-/-9=?A-Z\^-~](\.?[!#-'*+\-/-9=?A-Z\^-~])*
is the same dot-atom form as above, but here it represents domain names and IPv4 addresses.
\[[!-Z\^-~]*\]
will match IPv6 addresses and future definitions of host names.
This regular expression allows all specification-compliant email addresses, and can be used verbatim in a MIME message (except for line length limits, in which case folding whitespace must be added).
This also sets non-capturing groups such that match[1]
will be the user, match[2]
will be the host. (However if match[1]
starts with a double quote, then filter out backslash escapes, and the start and end double quotes: "root"@example.com
and root@example.com
identify the same inbox.)
Finally, note that RFC 5321 sets limits on how long an email address may be. The user part may be up to 64 bytes, and the domain part may be up to 255 bytes. Including the @
character, the limit for the entire address is 320 bytes. This is measured in bytes after the address is UTF-8 encoded; not characters.
Note that RFC 5322 ABNF defines a permissive syntax for domain names, allowing names currently known to be invalid. This also allows for domain names that could become legal in the future. This should not be a problem, as this should be handled the same way a non-existent domain name is.
Always consider the possibility that a user typed in an email address that works, but that they do not have access to. The only foolproof way to verify an email address is to send an email.
This is adapted from my article E-Mail Addresses & Syntax.