I tend to use something like this rule, too. Except that I don't like having an IP in the domain part (it's valid, but screams spam), and a FQDN instead of a (p

I tend to use something like this rule, too. Except that I don't like having an IP in the domain part (it's valid, but screams spam), and a FQDN instead of a (possibly local/internal) hostname. So /.+@.+\..+/ it is for me (plus checking it's not an IP). Unless of course the application interacts with intranet hostnames, but imho those should be avoided these days anyway. Imho it's more important to allow a user to fix a mistake: "We sent you a confirmation e-mail to $email_address. Spotted a mistake? Click here to change your email address."