The Correct Way to Validate Email Addresses
I always assumed it was more a sanitization issue for security&#x27;s sake. By allowing only a simple subset (&quot;common&quot;) email address type, you can be ambivalent about what email server is running and how it reacts to the wide variety of specially crafted email addresses.<p>With no validation other than sending the email, you have to know, for example, what the server would do with an email address that claims to be @localhost. Now it becomes a problem- or at least a question and concern- for the backend system. Whether the backend interprets root@localhost as valid and does exactly what it&#x27;s told or rejects it due to some configuration- it has become a backend complication and a DOS attack vector.<p>A simple policy of only handling a subset- the common class of email addresses- is one of the things that allows us to have a simple mental model of what the MTA is supposed to do. The fact that it sometimes caught a type-o, or not, is incidental. &quot;Invalid email&quot; wasn&#x27;t meant to imply the email address doesn&#x27;t fit the spec- it was meant to imply that a particular site or service has chosen not to accept email addresses like that.<p>Or at least that&#x27;s what I assumed :-)