The best validation for a valid email address is always sending a verification mail. I’ve rejected countless MRs that contained ad-hoc regex email validation copied from the internet. I’d allow a check for it to contain an @.