Electronic Mail Address

Identifies electronic mail addresses in local-part@domain.tld form using a pragmatic RFC 5322 / WHATWG HTML Living Standard subset: bounded local-part (64 characters, per RFC 5321) and domain-label quantifiers, not the full RFC 5322 address-list grammar (no quoted-string local parts, comments, or domain literals). Unlike the WHATWG "valid e-mail address" definition, a dotted domain ending in an alphabetic (or xn-- punycode) top-level label is required, so dotless intranet values such as user@localhost are deliberately excluded. Retina image asset names (logo@2x.png) are rejected in the primary. Absorbs the former global-email-address classifier.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the bounded local-part@domain.tld structure with an alphabetic top-level label is distinctive to email addresses, and Retina asset names (logo@2x.png) are rejected in the primary. Residual collisions (package@1.2.build-style version tokens) stay at the discovery-only 65 tier unless an email label is present.
Detection quality: Mixed
Jurisdictions: global
Regulations: GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), CCPA/CPRA
Frameworks: ISO 27001, ISO 27701, SOC 2
Data categories: pii, contact-information
Scope: wide
Risk rating: 5
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

\b[A-Za-z0-9][A-Za-z0-9.!#$%&'*+/=?^_{|}~-]{0,63}@(?![1-4]x\.(?:png|jpe?g|gif|webp|svg)\b)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?){0,7}\.(?:[A-Za-z]{2,24}|xn--[A-Za-z0-9-]{1,59})\b

Corroborative evidence keywords

electronic mail, correspondence address, inbox, mailbox, e-mail address, send to, reply to, contact email, personal email, work email, mailto, email, e-mail, email address, email:, e-mail:, business email, address, age, birthday (+25 more)

Proximity: 300 characters

Should match

alerts@agency.gov.au — Low-tier probe - valid email structure without correspondence context
Inbox: service.desk@agency.gov.au — Medium-tier probe - email with an explicit correspondence label
Customer record - email address: jane_doe+work@company.com.au — High-tier probe - labelled email in an independent customer-record context
Send to info@government.gov.au — Medium-tier labelled government email address
Customer contact record 44871; account holder Priya Raman; contact email: priya.raman77@northwind.com.au; preferred channel: email — Exact 85 probe carried from global-email-address - labelled address in a populated contact record
Please reach j.smith+news99@sub.example.co.uk today. — Plus-addressing local part with a multi-label subdomain and double TLD (bounded RFC 5322 subset)
Employee directory record - work email: user_name-99@my-domain123.org — Underscore/hyphen local part with a hyphenated, digit-bearing domain label in a directory record

Should not match

The ratio is 3@4 per unit — At symbol used in non-email context
user@localhost — Local address without valid TLD
@mention in chat — Social media mention, no local part
Documentation example: user@example.com — Reserved-domain example explicitly framed as documentation
Asset manifest for the email banner: logo@2x.png, icon@3x.png — Retina image asset filenames are rejected by the primary even beside an email label
Public website contact email: media@agency.gov.au — Published generic contact address is vetoed from enforcement by public-contact context
Media release: for media enquiries email press@agency.gov.au. The customer record system upgrade is complete. — News/media-release decoy with email label and record wording is vetoed by public-contact context
Sample template: customer contact record; contact email: jane.doe@northwind.com.au — Template text contains high-tier evidence but is vetoed by the shared exclusion
Privacy policy: staff must not forward a customer email address or account holder details to personal mailboxes. — Policy prose with email and record wording but no address value
Customer profile URL: https://example.org/people/jane-doe — Sibling contact locator contains no email-address primary

Known false positives

At symbols in code, formulas, or social media handles. Mitigation: Require a dotted domain with an alphabetic top-level label after the @.
Retina-resolution image asset filenames such as logo@2x.png or icon@3x.png structurally satisfy local-part@domain.tld. Mitigation: The primary rejects @1x-@4x followed by a common image extension; other asset tokens stay at the discovery-only 65 tier unless email evidence is present.
Source annotations, changelog entries, or CI badge URLs containing an @ followed by a dotted version-like token (e.g. package@1.2.build) can coincidentally satisfy the structural pattern. Mitigation: Layer with file-type/content-type context (exclude source-code paths) and require email-label evidence at the 75 tier.
Published public-contact mailboxes (media enquiries, public website or directory contacts). Mitigation: Public-contact context is a NOT-group on the 75 and 85 tiers.