The Regex That Trusted Email — JavaScript Bug Hunt

Briefing

Inspired by the bounce storms behind every "we emailed you a receipt" pipeline: the validator is /.+@.+/, so a@b@c, "has spaces"@x and domains without a dot all get queued, bounce, and tank the sender reputation.

Tighten emailCheck.js to the sane subset.

Bug report

BUG-MX · Reported by: deliverability

isValid(email) — pragmatic rules:

• exactly one "@", no whitespace anywhere
• local part non-empty
• domain contains at least one ".", with a TLD of 2+ letters

Observed: 12% of the queue is structurally impossible addresses.

Logs

[smtp] 550 loop detected for "ceo@corp@corp"

The code as shipped

src/mail/emailCheck.js (editable)

// Structural email validation.
exports.isValid = function (email) {
  return /.+@.+/.test(email);
};