The parent's regular expression covers the most egregious typos without making any assumptions about domain names or tlds. If you wanted to help out with common typos you could add additional logic to specifically check for "*@gmial.com" or other permutations of the common domains. If you wanted to get really fancy, you could even run it by an edit distance function against the common domains and warn if they're close to a common one but not quite there.

Most typos, however, are likely to be in the first part, not in the domain. The only real way to validate against those is to try the address and see.

A small subset of typos. bob@mail.com and bob@mial.com will pass the same validation rules.

A regex won't catch typos. Send an email, or if you really want force to enter twice. The rfc is both so permissive and generic that pretty much anything will pass it, while at the same time it is very hard to test it, so you might block legitimate ones. MSFT for example allows you to use your personal email as a MSFT account. If you username is less than 3 letters some of the validation they do in some of the subsystems will reject it as invalid that they even validated with a confirmation email. I can't count the number of systems which reject + in a username or a subdomain in the host. Truly you're just making it harder for the users and for yourself.

But the proof of the validation is in the sending. If it’s important I send a validation email