I've always been under the assumption that the browser email-validation-regex is more robust than some regex pattern in JS/PHP.

My employer just showed me that both strings are considered correct (at last in FF28):

test@test.com // Expected to be true, is true
test@test     // Expected to be false, is true

Why is the latter true? Is this a bug, or something for the future? Because as far as I can tell, it's not correct to not use a extention (apart from maybe localhosts).

Anyone who can shed some light on this?

  • 2
    "apart from maybe localhosts" - and how does the browser differentiate? – MrWhite Apr 16 '14 at 10:45
  • 1
    Futhermore, I consider that <input type="email" /> is only useful for mobile websites, so that most of the keyboards will show up with an appropriate display (with the @ key, and some .com shortcuts…). – RichouHunter Apr 16 '14 at 10:51
  • I don't know, I dont build browsers :) Might be a clever trick, or maybe some setting you could add to pattern – Martijn Apr 16 '14 at 11:06
  • 6
    That's a perfectly valid address, why would it be rejected? – Jörg W Mittag Apr 16 '14 at 11:44
  • 1
    because test@test is a valid email address... it treats test as a tld. Just like test@com is a valid email address for the com tld... tools.ietf.org/html/rfc2822#section-3.4.1 – SnakeDoc Apr 16 '14 at 21:54

It is valid because test could be a top-level domain and localpart@top-level-domain is a valid email address.

See for example Email address, domain part

  • And since ICANN now has a process for anyone (big enough) to apply for the TLD of their choice, it's not really feasible any more for an email validator to reject test as a TLD just because it happens not to be registered yet. – Steve Jessop Apr 16 '14 at 9:51
  • 1
    @SteveJessop Furthermore the OP did not specify if he is speaking of syntactic validity (the email would be valid even if not registered) or if he is speaking of checking if the email works (and in this case much more would be needed) ... – Matteo Apr 16 '14 at 9:59
  • Not checking if it exists, I was surprised the domain extention wasn't required. This would make the browser validation a lot less usefull, as someone only has to type asd@ads and it'll pass. – Martijn Apr 16 '14 at 10:40
  • 5
    @Martijn: The "browser validation" is just a first line validation check (that is easily bypassed), so it needs to be the broadest possible check. The final "strict" validation still needs to be in your server-side logic. – MrWhite Apr 16 '14 at 10:43

You could edit your hosts file or run a DNS server on a local network to create a machine with a top level domain name. The email address will be only accessible if it's routed only within that local network but it's a possible configuration.


Note also that web browsers are not required to perform any validation checks. Older browsers don't do anything special with the email address. Newer browsers may validate, but the 'email' type is most useful on mobile devices where a specialized keyboard may be shown to the user.

Your Answer

