What validation checks would you implement for a user-submitted email field?

WHAT THIS TESTS: The interviewer wants to see if you treat email validation as a multi-layer data-quality problem rather than a single regex check. At the ingestion point, the goal is to catch garbage early without falsely rejecting valid addresses or claiming you can verify deliverability in real time.

A GOOD ANSWER COVERS: A good answer hits four things in order. First, syntax validation against RFC 5322 addr-spec rules for the local-part and domain, noting that overly strict regexes reject valid emails like those containing plus signs or quoted strings. Second, domain-level validation such as checking the domain is not a typo of a common provider, verifying it has a valid DNS A or MX record, and rejecting disposable email domains if business rules require it. Third, normalization including trimming whitespace, lowercasing the domain, and optionally lowercasing the local-part depending on provider rules since some mailboxes are case-sensitive. Fourth, operational guards such as deduplication within the batch, rate limiting per IP or user, and logging validation failures for monitoring.

COMMON WRONG ANSWERS: A common wrong answer is presenting a single massive regex as the complete solution; this misses edge cases and creates maintenance nightmares. Another red flag is suggesting you send a verification email and call it ingestion validation; while confirmation is the only true deliverability test, it is an outbound action, not an ingestion guard. Claiming that validating against RFC 5322 guarantees the mailbox exists is also incorrect.

LIKELY FOLLOW-UPS: An interviewer might ask how you would handle internationalized domain names or emails with Unicode local-parts. They might also ask how to prevent enumeration attacks during validation, or how you would store emails securely to support GDPR right-to-erasure requests.

ONE CONCRETE EXAMPLE: Suppose you are ingesting a CSV of ten thousand signups. At ingestion, you would trim whitespace and reject rows where the email lacks an at-sign or has an invalid domain syntax. You would then check DNS for MX records on the domain and reject rows with domains like example.con that have no MX. You would normalize the domain to lowercase, deduplicate the list to remove three thousand duplicate entries, and write the two hundred rejected rows to a dead-letter queue for manual review before loading the clean set into the warehouse.