^[^@\s]+@[^@\s]+$ and move on. Every stricter one I've seen in production rejects somebody's real address, usually with a plus sign or a newer TLD in it.