Email Address

Detects email addresses in local-part@domain.tld form using a pragmatic RFC 5322 / WHATWG HTML Living Standard subset: bounded local-part and domain-label quantifiers, not the full RFC 5322 address-list grammar (no quoted-string local parts, no comments, no domain literals). Note one deliberate divergence from the WHATWG "valid e-mail address" definition: WHATWG accepts a single-label (dotless) domain such as user@localhost, whereas this pattern requires at least one dot-separated label after the host name — dotless domains are effectively intranet-only values and matching them would sharply raise false positives on code and asset tokens, so this is a subset of WHATWG on that axis, not an exact implementation. This is a genuine value-format identifier, distinct from the existing global-top500-044/045 concept patterns, which only match topic phrases such as "personal email" or "work email" and do not extract an actual address value.

Type: regex
Engine: universal
Confidence: medium
Confidence justification: Medium confidence: the local-part@domain.tld structure is distinctive enough to stand alone at the 65 (discovery) tier, but it is not immune to false positives — Retina-resolution image asset filenames (logo@2x.png) and some version/build tokens can coincidentally match the same shape. The 75 tier requires independent "email"/"contact" evidence to raise confidence for labelled occurrences.
Jurisdictions: global
Regulations: GDPR, CCPA/CPRA
Frameworks: ISO 27001, ISO 27701, SOC 2
Data categories: pii, contact-information
Scope: narrow
Risk rating: 3
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b[A-Za-z0-9][A-Za-z0-9.!#$%&'*+/=?^_{|}~-]{0,63}@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?){1,8}\b

Corroborative evidence keywords

email address, email, e-mail, contact email, personal email, work email, send an email, reply to, mailto, address, age, birthday, citizenship, city, date of birth, [object Object], ethnicity, fax, first name, full name (+17 more)

Proximity: 300 characters

Should match

Customer contact record; contact email: jane.doe@northwind.com.au — Exact 85 probe - labelled address in a populated contact-record context
jane.doe@example.com — Simple dot-atom local part with a common two-label domain
Please reach j.smith+news99@sub.example.co.uk today. — Plus-addressing local part with a multi-label subdomain and double TLD
user_name-99@my-domain123.org — Underscore/hyphen local part with a hyphenated, digit-bearing domain label
Contact email: jane.doe@northwind.com.au for details. — Address value embedded in a labelled sentence

Should not match

not an email address at all — No @ sign present anywhere in the string
user@localhost — Domain has no top-level label — no dot follows the host name (WHATWG-valid but deliberately excluded here; see the divergence note in the description)
@missinglocalpart.com — No local-part characters precede the @ sign
Public website contact email: media@example.org — Published generic contact address is vetoed from enforcement by public-contact context
Sample template: customer contact record; contact email: jane.doe@example.com — Template text contains high-tier evidence but is vetoed by the shared exclusion
Customer profile URL: https://example.org/people/jane-doe — Sibling contact locator contains no email-address primary

Known false positives

Retina-resolution image asset filenames such as logo@2x.png or icon@3x.png structurally satisfy local-part@domain.tld and will match the bare 65-tier value regex. Mitigation: Require corroborative "email"/"contact" evidence keywords within the proximity window; treat the 65 discovery tier as triage input rather than a standalone alert.
Source annotations, changelog entries, or CI badge URLs containing an @ followed by a dotted version-like token (e.g. package@1.2.build) can coincidentally satisfy the structural pattern. Mitigation: Layer with file-type/content-type context (exclude source-code and image-asset paths) and require email-context evidence at the 75 tier.