Regex to Match an Email Address and Reject Fake Ones
Start with shape, end with verification. A regex can reject malformed and obviously fake addresses, but it cannot tell you whether the mailbox actually exists — that information is not in the string. The pattern below is a solid starting filter; everything else is layered checks on top of it.
^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$The questions below cover the limits and the layered approach.
What is the most common regex pattern for matching an email address?
The short version everyone starts with: ^[^@\s]+@[^@\s]+\.[^@\s]+$. It rejects strings with spaces and requires one @ with a dot after it. It is a good first filter and a bad final one — plenty of fake inputs like [email protected] pass through.
Why does a simple email regex still match fake addresses?
Because regex only checks the shape, not the mailbox. [email protected] is a valid shape but useless in practice. A regex can reject malformed strings, but it can't know whether the address exists, is disposable, or belongs to someone. Format checks and existence checks are different jobs.
Should I use one long regex or several small checks?
Several small checks. A single monster pattern is hard to read, easy to break, and still gets bypassed. Do it in layers: length limit, no spaces, exactly one @, a domain with a dot, allowed character set. Each layer is testable on its own.
How do I reject obviously fake email addresses with regex?
Block the cheap tells first: addresses like test@, qwerty@, or [email protected], plus common placeholder domains like example.com. Keep the blacklist short and explicit. Anything beyond that — catch disposable domains, verify the mailbox, check if the domain resolves — needs more than regex.
Do regex email checks work for user signup forms?
As a first gate, yes. As the only gate, no. Use the regex to reject the clearly invalid input, then do a real check: confirm the domain has an MX record, and send a verification email. Most fake signups pass the regex and die at the verification step.
What characters are actually allowed in an email address?
The local part allows letters, digits, and ._%+- in most real-world implementations, and the domain part is much stricter: letters, digits, hyphens, and dots. Most sites deliberately support less than the full RFC 5322 spec — that's fine, be strict for your own use case.
Why do some regexes allow a dot at the start or end of the local part?
Because they copied a pattern that was never tested against edge cases. A dot at the start, end, or in a double-dot sequence like [email protected] is invalid per the spec. If you want correct output, anchor the pattern and add the dot rules explicitly.
Is there a regex that rejects 100% of fake emails?
No. There is no regex in existence that separates a real mailbox from a fake one, because that information isn't in the string. The best a regex can do is reject the malformed and the obvious fakes. After that you verify, you don't pattern-match.
Test your own pattern against tricky inputs in the email regex tester here before you ship it.
