You can, and should, knock out the really obvious stuff with regex validation but you're smart to be concerned about one thing that most people miss in this con

You can, and should, knock out the really obvious stuff with regex validation but you're smart to be concerned about one thing that most people miss in this conversation. A confirmation email doesn't solve the problem if the user mistyped the address to begin with. You're right, they wait for a confirmation email that never comes. Using a third party service like BriteVerify's rest api is the only way to get an actual verification that the inbox exists.