TL;DR the odds that the user entered an incorrect-but-valid address are way higher than that they entered one which will not actually be able to receive mail. Send a validation email.
In other words, it does make sense to check that they entered an '@' symbol somewhere, since it shows that they understood it was an email field. Any 'validation' beyond that is useless.
@ signs are also permitted in comments: (ted@home)ted@example.invalid is also a valid email address.
I got a popular givenname.familyname@gmail.com address and I frequently get mail that's meant for other people who share my name. The vast majority of the time it's the individual themselves who sign up for a service or offering but there's rarely a validation upfront.
The best emails are the ones who extend full trust to the email recipient over some account during that first email. Facebook, shame on you.
Well what else would you have them do? Have people enter their address and send letters there to do a password reset?
A confirmation email before full trust is going to do little: a malicious person would just click that link, right?
There are an amazing number of C. R. Conrad's in the world -- mostly the USA -- who seem to think they own that address.
For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated.
If you're looking for a username as login identity and nothing more (and you don't have password reset functionality), then ask for a 'username', not email addresses.
Not true. There are people who share an email address.
Once upon a time, you only got one or two email addresses from your email provider (I'm looking at you, CompuServe and AOL), so at that time it was common for everyone in a family to have a single address. Eventually they added explicit multi-user features -- IIRC, AOL went as high as 5 emails per account before my family moved on.
I designed a system once around the assumption of a 1:1 mapping between people and email addresses. I will never design another system that way.
If you block that, you're going to lose users. Either because they just can't sign up at all, or because there's too much unnecessary friction in requiring someone to go out and sign up for an email address just to register for your service.
Failure to do so means:
- The user who actually owns that e-mail can't login
- The user who signs up can potentially impersonate the real user (depending on what your app does)
- The user who signs up can't reset their password
- The user who actually owns the e-mail can take ownership of the account (by resetting password)
One argument against emails-as-names is that some people change email addresses frequently - unless you have some way of accounting for that (and you definitely wouldn't use the username as the contact field), the username will eventually go stale for some users.
At the same time, as a user, you need to consider your own e-mail setup. You should not use your ISP-provided e-mail address whatsoever, there is absolutely no reason to tie your contact to an account you may not keep.
Likewise, you should not be using your school or work-provided addresses for something that you expect to use beyond going to school or having that job.
If you're changing your e-mail address frequently for personal reasons (eg, someone harassing you?), then you should actually consider creating an account you use only for authentication, and a separate one that is your public-facing persona.
Having separate addresses for your contact and sign-ups is actually not a bad idea anyway. It actually makes it a bit harder for someone to break into your account somewhere (because they don't necessarily know what address you used), and you get the freedom to change/abandon your public e-mail address if necessary.
Mailing list - reluctant OK
"avoiding sending private info to the wrong user" - how could this happen?
"avoiding allowing someone to masquerading or impersonate someone they're not" - how could this happen? Like if I signed up as tim@apple.com? What could realistically happen?
And when they do, it's usually mine.