The vast majority (probably over 99%) of the email addresses still use the pre-2012 rules described in Wikipedia:
The local-part of the email address may use any of these ASCII characters:
- uppercase and lowercase Latin letters
- printable characters others than letters and digit
., provided that it is not the first or last character unless quoted, and provided also that it does not appear consecutively unless quoted (e.g. John..Doe@example.com is not allowed but "John..Doe"@example.com is allowed);
So for starters, you can whitelist all ASCII characters; if you feel a little more fancy, you can use a regular expression, e.g. one of those listed here.
The HTML element
input with type
email, which is often used in web forms, uses the following regex for validation:
Yes, this does mean that letters diacritical marks like @JörgMittag's
ö cannot be used: see this Regex101 example. Whether it's worth expanding the regex/character validation to non-ASCII characters depends on your user base. I see you're from Canada; there might be French-speaking users with accented letters in their names and email addresses. If those really need to be supported, check which characters your backend supports (e.g. all ISO-8859-1 characters) and just whitelist those.