Email Validation for Web Forms: Client-Side and Server-Side Techniques

Why Form-Level Email Validation Matters

Every email address that enters your database through a web form affects your data quality, deliverability and marketing ROI. Validation at the point of entry prevents bad data from ever getting in:

Validation Layers

Email validation works best as a layered system. Each layer catches different types of errors:

Client-Side Validation

HTML5 built-in validation

The simplest validation is the HTML5 type="email" attribute, which browsers validate automatically:

<form>
  <label for="email">Email address</label>
  <input
    type="email"
    id="email"
    name="email"
    required
    placeholder="you@example.com"
  />
  <button type="submit">Subscribe</button>
</form>

JavaScript validation

For more control, add JavaScript validation that runs when the user leaves the email field:

function validateEmail(email) {
  const errors = [];

  // Basic format check
  const formatRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  if (!formatRegex.test(email)) {
    errors.push('Please enter a valid email address.');
    return errors;
  }

  const [localPart, domain] = email.split('@');

  // Check local part length (RFC 5321: max 64)
  if (localPart.length > 64) {
    errors.push(
      'The part before @ is too long (max 64 characters).'
    );
  }

  // Check domain length (RFC 5321: max 255)
  if (domain.length > 255) {
    errors.push(
      'The domain name is too long (max 255 characters).'
    );
  }

  // Check for common typos
  const typoSuggestion = checkCommonTypos(domain);
  if (typoSuggestion) {
    errors.push(
      `Did you mean @${typoSuggestion}?`
    );
  }

  return errors;
}

function checkCommonTypos(domain) {
  const corrections = {
    'gmial.com': 'gmail.com',
    'gmaill.com': 'gmail.com',
    'gamil.com': 'gmail.com',
    'gmal.com': 'gmail.com',
    'gmail.co': 'gmail.com',
    'gmail.con': 'gmail.com',
    'gnail.com': 'gmail.com',
    'yahooo.com': 'yahoo.com',
    'yaho.com': 'yahoo.com',
    'yahoo.co': 'yahoo.com',
    'hotmial.com': 'hotmail.com',
    'hotmal.com': 'hotmail.com',
    'hotmail.co': 'hotmail.com',
    'outlok.com': 'outlook.com',
    'outloo.com': 'outlook.com',
    'outlook.co': 'outlook.com',
  };
  return corrections[domain.toLowerCase()] || null;
}

Common regex patterns

Recommendation

Use the loose regex for client-side validation. Overly strict regex patterns reject valid email addresses (addresses with plus signs, long TLDs, internationalised domain names). Let the server-side validation and real-time API do the heavy lifting.

Server-Side Validation

Server-side validation is required regardless of client-side validation, because client-side checks can be bypassed:

Python (Flask) example

import re
import dns.resolver

def validate_email_server(email):
    """Validate email on the server side."""
    errors = []

    # 1. Format check
    pattern = r'^[^\s@]+@[^\s@]+\.[^\s@]+$'
    if not re.match(pattern, email):
        errors.append('Invalid email format.')
        return errors

    local_part, domain = email.rsplit('@', 1)

    # 2. Length checks (RFC 5321)
    if len(local_part) > 64:
        errors.append('Local part exceeds 64 characters.')
    if len(domain) > 255:
        errors.append('Domain exceeds 255 characters.')
    if len(email) > 254:
        errors.append(
            'Email address exceeds 254 characters.'
        )

    # 3. DNS MX record check
    try:
        mx_records = dns.resolver.resolve(
            domain, 'MX'
        )
        if not mx_records:
            errors.append(
                'Domain does not accept email.'
            )
    except (
        dns.resolver.NoAnswer,
        dns.resolver.NXDOMAIN,
        dns.resolver.NoNameservers,
    ):
        errors.append('Domain does not exist.')
    except Exception:
        pass  # DNS timeout; allow through

    # 4. Disposable domain check
    disposable_domains = load_disposable_domains()
    if domain.lower() in disposable_domains:
        errors.append(
            'Please use a non-disposable email address.'
        )

    # 5. Role-based check
    role_prefixes = [
        'info', 'admin', 'support', 'sales',
        'contact', 'help', 'webmaster', 'postmaster',
        'noreply', 'no-reply',
    ]
    if local_part.lower() in role_prefixes:
        errors.append(
            'Please use a personal email address.'
        )

    return errors

Node.js (Express) example

const dns = require('dns').promises;

async function validateEmailServer(email) {
  const errors = [];

  // 1. Format check
  const formatRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  if (!formatRegex.test(email)) {
    errors.push('Invalid email format.');
    return errors;
  }

  const [localPart, domain] = email.split('@');

  // 2. Length checks
  if (localPart.length > 64) {
    errors.push('Local part too long.');
  }
  if (domain.length > 255) {
    errors.push('Domain too long.');
  }

  // 3. MX record check
  try {
    const mxRecords = await dns.resolveMx(domain);
    if (!mxRecords || mxRecords.length === 0) {
      errors.push('Domain does not accept email.');
    }
  } catch (err) {
    if (err.code === 'ENOTFOUND') {
      errors.push('Domain does not exist.');
    }
    // Timeout: allow through
  }

  return errors;
}

Real-Time API Verification

For the highest accuracy, use a third-party verification API that checks whether the mailbox actually exists:

Verification API providers

When to call the API

UX Best Practices

Common Validation Mistakes

Extracting and Validating Email Lists from Form Submissions

When you collect email addresses through multiple web forms (signup forms, contact forms, lead magnets, checkout flows, event registrations), export the submissions and upload the files to Email Extractor to extract and deduplicate email addresses across all form sources. This consolidates contacts collected through different forms into a single clean list and removes duplicates from users who submitted multiple forms.

Related Guides

• Real-Time Email Validation for Forms
• Email Syntax Validation
• Regex for Email Extraction
• Email Validation API Integration
• Email Verification vs Validation