Search code examples
email-validation

Are unquoted consecutive (like) special characters allowed in an email address?

I have found conflicting information when researching whether or not two or more of the same unquoted consecutive special characters are allowed in email addresses (!#$%&'*+-/=?^_`{|}~).

For example, I know these are legal:
- [email protected]
- my" $$"[email protected]

I also know that leading, trailing, and double periods are illegal. My question is- is something like this legal:
- my&&[email protected]

Thanks!

Solution

  • From RFC 5322, the "atom" is the basic unit defining what can be in an e-mail address:

    atext           =   ALPHA / DIGIT /    ; Printable US-ASCII
                       "!" / "#" /        ;  characters not including
                       "$" / "%" /        ;  specials.  Used for atoms.
                       "&" / "'" /
                       "*" / "+" /
                       "-" / "/" /
                       "=" / "?" /
                       "^" / "_" /
                       "`" / "{" /
                       "|" / "}" /
                       "~"

atom            =   [CFWS] 1*atext [CFWS]

    "1*" is ABNF for "1 or more" so this production doesn't put any limits on the number of either characters allowed or their sequence. Thus in theory even "my&&&&&&&&[email protected]" would be legitimate.

    Whether this would work as a practical matter is implementation defined; for instance gmail ignores all dots in the local-part of the address to prevent basic spoofing attacks.