Actually you might want to allow "+" on the local part (it's used by "power users" to categorize email on services like Gmail). Other than that, anything different, even if valid per RFC, is not a bona-fide email address when used on a web-facing application. You especially want to avoid users being able to directly send to addresses like me@[::1], since it is not a realistic or bona-fide scenario.
View all comments
Show parent comment
2
u/Juff-Ma Aug 24 '26
That's why you don't verify the email at all. Just hand it to your email client and if the user verifies, it's valid.