email-validator 2.2.0__tar.gz → 2.4.0__tar.gz

{email_validator-2.2.0/email_validator.egg-info → email_validator-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
-Name: email_validator
-Version: 2.2.0
+Metadata-Version: 2.4
+Name: email-validator
+Version: 2.4.0
 Summary: A robust email address syntax and deliverability validation library.
 Home-page: https://github.com/JoshData/python-email-validator
 Author: Joshua Tauberer
@@ -11,23 +11,25 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: The Unlicense (Unlicense)
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.8
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: dnspython>=2.0.0
 Requires-Dist: idna>=2.0.0
+Dynamic: license-file
 
 email-validator: Validate Email Addresses
 =========================================
 
 A robust email address syntax and deliverability validation library for
-Python 3.8+ by [Joshua Tauberer](https://joshdata.me).
+Python 3.10+ by [Joshua Tauberer](https://joshdata.me).
 
 This library validates that a string is of the form `name@example.com`
 and optionally checks that the domain name is set up to receive email.
@@ -37,7 +39,7 @@ users by their email address like on a registration form.
 Key features:
 
 * Checks that an email address has the correct syntax --- great for
-  email-based registration/login forms or validing data.
+  email-based registration/login forms or validating data.
 * Gives friendly English error messages when validation fails that you
   can display to end-users.
 * Checks deliverability (optional): Does the domain name resolve?
@@ -168,13 +170,14 @@ The `validate_email` function also accepts the following keyword arguments
 
 `allow_quoted_local=False`: Set to `True` to allow obscure and potentially problematic email addresses in which the part of the address before the @-sign contains spaces, @-signs, or other surprising characters when the local part is surrounded in quotes (so-called quoted-string local parts). In the object returned by `validate_email`, the normalized local part removes any unnecessary backslash-escaping and even removes the surrounding quotes if the address would be valid without them. You can also set `email_validator.ALLOW_QUOTED_LOCAL` to `True` to turn this on for all calls by default.
 
-`allow_domain_literal=False`: Set to `True` to allow bracketed IPv4 and "IPv6:"-prefixd IPv6 addresses in the domain part of the email address. No deliverability checks are performed for these addresses. In the object returned by `validate_email`, the normalized domain will use the condensed IPv6 format, if applicable. The object's `domain_address` attribute will hold the parsed `ipaddress.IPv4Address` or `ipaddress.IPv6Address` object if applicable. You can also set `email_validator.ALLOW_DOMAIN_LITERAL` to `True` to turn this on for all calls by default.
+`allow_domain_literal=False`: Set to `True` to allow bracketed IPv4 and "IPv6:"-prefixed IPv6 addresses in the domain part of the email address. No deliverability checks are performed for these addresses. In the object returned by `validate_email`, the normalized domain will use the condensed IPv6 format, if applicable. The object's `domain_address` attribute will hold the parsed `ipaddress.IPv4Address` or `ipaddress.IPv6Address` object if applicable. You can also set `email_validator.ALLOW_DOMAIN_LITERAL` to `True` to turn this on for all calls by default.
 
 `allow_display_name=False`: Set to `True` to allow a display name and bracketed address in the input string, like `My Name <me@example.org>`. It's implemented in the spirit but not the letter of RFC 5322 3.4, so it may be stricter or more relaxed than what you want. The display name, if present, is provided in the returned object's `display_name` field after being unquoted and unescaped. You can also set `email_validator.ALLOW_DISPLAY_NAME` to `True` to turn this on for all calls by default.
 
 `allow_empty_local=False`: Set to `True` to allow an empty local part (i.e.
     `@example.com`), e.g. for validating Postfix aliases.
     
+`strict=False`: Set to `True` to perform additional syntax checks (currently only a local part length check). This should be used by mail service providers at address creation to ensure email addresses meet broad compatibility requirements.
 
 ### DNS timeout and cache
 
@@ -381,7 +384,9 @@ ValidatedEmail(
 
 Now `smtputf8` is `True` and `ascii_email` is `None` because the local
 part of the address is internationalized. The `local_part` and `normalized` fields
-return the normalized form of the address.
+return the normalized form of the address. (Because of Unicode normalization,
+it is possible in edge cases for `smtputf8` to be `True` based on the original
+email address when `ascii_email` is also present in the ValidatedEmail.)
 
 Return value
 ------------
@@ -449,8 +454,7 @@ To release:
 * Update CHANGELOG.md.
 * Update the version number in `email_validator/version.py`.
 * Make & push a commit with the new version number and make sure tests pass.
-* Make & push a tag (see command below).
-* Make a release at https://github.com/JoshData/python-email-validator/releases/new.
+* Make a release at https://github.com/JoshData/python-email-validator/releases/new creating a new tag (or use command below).
 * Publish a source and wheel distribution to pypi (see command below).
 
 ```sh

{email_validator-2.2.0 → email_validator-2.4.0}/README.md

@@ -2,7 +2,7 @@ email-validator: Validate Email Addresses
 =========================================
 
 A robust email address syntax and deliverability validation library for
-Python 3.8+ by [Joshua Tauberer](https://joshdata.me).
+Python 3.10+ by [Joshua Tauberer](https://joshdata.me).
 
 This library validates that a string is of the form `name@example.com`
 and optionally checks that the domain name is set up to receive email.
@@ -12,7 +12,7 @@ users by their email address like on a registration form.
 Key features:
 
 * Checks that an email address has the correct syntax --- great for
-  email-based registration/login forms or validing data.
+  email-based registration/login forms or validating data.
 * Gives friendly English error messages when validation fails that you
   can display to end-users.
 * Checks deliverability (optional): Does the domain name resolve?
@@ -143,13 +143,14 @@ The `validate_email` function also accepts the following keyword arguments
 
 `allow_quoted_local=False`: Set to `True` to allow obscure and potentially problematic email addresses in which the part of the address before the @-sign contains spaces, @-signs, or other surprising characters when the local part is surrounded in quotes (so-called quoted-string local parts). In the object returned by `validate_email`, the normalized local part removes any unnecessary backslash-escaping and even removes the surrounding quotes if the address would be valid without them. You can also set `email_validator.ALLOW_QUOTED_LOCAL` to `True` to turn this on for all calls by default.
 
-`allow_domain_literal=False`: Set to `True` to allow bracketed IPv4 and "IPv6:"-prefixd IPv6 addresses in the domain part of the email address. No deliverability checks are performed for these addresses. In the object returned by `validate_email`, the normalized domain will use the condensed IPv6 format, if applicable. The object's `domain_address` attribute will hold the parsed `ipaddress.IPv4Address` or `ipaddress.IPv6Address` object if applicable. You can also set `email_validator.ALLOW_DOMAIN_LITERAL` to `True` to turn this on for all calls by default.
+`allow_domain_literal=False`: Set to `True` to allow bracketed IPv4 and "IPv6:"-prefixed IPv6 addresses in the domain part of the email address. No deliverability checks are performed for these addresses. In the object returned by `validate_email`, the normalized domain will use the condensed IPv6 format, if applicable. The object's `domain_address` attribute will hold the parsed `ipaddress.IPv4Address` or `ipaddress.IPv6Address` object if applicable. You can also set `email_validator.ALLOW_DOMAIN_LITERAL` to `True` to turn this on for all calls by default.
 
 `allow_display_name=False`: Set to `True` to allow a display name and bracketed address in the input string, like `My Name <me@example.org>`. It's implemented in the spirit but not the letter of RFC 5322 3.4, so it may be stricter or more relaxed than what you want. The display name, if present, is provided in the returned object's `display_name` field after being unquoted and unescaped. You can also set `email_validator.ALLOW_DISPLAY_NAME` to `True` to turn this on for all calls by default.
 
 `allow_empty_local=False`: Set to `True` to allow an empty local part (i.e.
     `@example.com`), e.g. for validating Postfix aliases.
     
+`strict=False`: Set to `True` to perform additional syntax checks (currently only a local part length check). This should be used by mail service providers at address creation to ensure email addresses meet broad compatibility requirements.
 
 ### DNS timeout and cache
 
@@ -356,7 +357,9 @@ ValidatedEmail(
 
 Now `smtputf8` is `True` and `ascii_email` is `None` because the local
 part of the address is internationalized. The `local_part` and `normalized` fields
-return the normalized form of the address.
+return the normalized form of the address. (Because of Unicode normalization,
+it is possible in edge cases for `smtputf8` to be `True` based on the original
+email address when `ascii_email` is also present in the ValidatedEmail.)
 
 Return value
 ------------
@@ -424,8 +427,7 @@ To release:
 * Update CHANGELOG.md.
 * Update the version number in `email_validator/version.py`.
 * Make & push a commit with the new version number and make sure tests pass.
-* Make & push a tag (see command below).
-* Make a release at https://github.com/JoshData/python-email-validator/releases/new.
+* Make a release at https://github.com/JoshData/python-email-validator/releases/new creating a new tag (or use command below).
 * Publish a source and wheel distribution to pypi (see command below).
 
 ```sh

{email_validator-2.2.0 → email_validator-2.4.0}/email_validator/__init__.py

@@ -1,8 +1,8 @@
 from typing import TYPE_CHECKING
 
 # Export the main method, helper methods, and the public data types.
-from .exceptions_types import ValidatedEmail, EmailNotValidError, \
-                              EmailSyntaxError, EmailUndeliverableError
+from .exceptions import EmailNotValidError, EmailSyntaxError, EmailUndeliverableError
+from .types import ValidatedEmail
 from .validate_email import validate_email
 from .version import __version__
 
@@ -27,9 +27,11 @@ else:
 # Default values for keyword arguments.
 
 ALLOW_SMTPUTF8 = True
+ALLOW_EMPTY_LOCAL = False
 ALLOW_QUOTED_LOCAL = False
 ALLOW_DOMAIN_LITERAL = False
 ALLOW_DISPLAY_NAME = False
+STRICT = False
 GLOBALLY_DELIVERABLE = True
 CHECK_DELIVERABILITY = True
 TEST_ENVIRONMENT = False

{email_validator-2.2.0 → email_validator-2.4.0}/email_validator/__main__.py

@@ -12,33 +12,39 @@
 # When using STDIN, no output will be given for valid email addresses.
 #
 # Keyword arguments to validate_email can be set in environment variables
-# of the same name but upprcase (see below).
+# of the same name but uppercase (see below).
 
 import json
 import os
 import sys
-from typing import Any, Dict, Optional
+from typing import Any, Optional
 
 from .validate_email import validate_email, _Resolver
 from .deliverability import caching_resolver
-from .exceptions_types import EmailNotValidError
+from .exceptions import EmailNotValidError
 
 
 def main(dns_resolver: Optional[_Resolver] = None) -> None:
     # The dns_resolver argument is for tests.
 
     # Set options from environment variables.
-    options: Dict[str, Any] = {}
-    for varname in ('ALLOW_SMTPUTF8', 'ALLOW_QUOTED_LOCAL', 'ALLOW_DOMAIN_LITERAL',
+    options: dict[str, Any] = {}
+    for varname in ('ALLOW_SMTPUTF8', 'ALLOW_EMPTY_LOCAL', 'ALLOW_QUOTED_LOCAL', 'ALLOW_DOMAIN_LITERAL',
+                    'ALLOW_DISPLAY_NAME',
                     'GLOBALLY_DELIVERABLE', 'CHECK_DELIVERABILITY', 'TEST_ENVIRONMENT'):
         if varname in os.environ:
-            options[varname.lower()] = bool(os.environ[varname])
+            # bool() would make any non-empty string True, so e.g.
+            # CHECK_DELIVERABILITY=false would enable the check.
+            options[varname.lower()] = os.environ[varname].strip().lower() not in ('', '0', 'false', 'no', 'off')
     for varname in ('DEFAULT_TIMEOUT',):
         if varname in os.environ:
-            options[varname.lower()] = float(os.environ[varname])
+            # DEFAULT_TIMEOUT is a module-level default read by
+            # caching_resolver(), not a keyword argument of validate_email.
+            import email_validator
+            email_validator.DEFAULT_TIMEOUT = int(os.environ[varname])
 
     if len(sys.argv) == 1:
-        # Validate the email addresses pased line-by-line on STDIN.
+        # Validate the email addresses passed line-by-line on STDIN.
         dns_resolver = dns_resolver or caching_resolver()
         for line in sys.stdin:
             email = line.strip()

{email_validator-2.2.0 → email_validator-2.4.0}/email_validator/deliverability.py

@@ -1,8 +1,8 @@
-from typing import Any, List, Optional, Tuple, TypedDict
+from typing import Any, Optional, TypedDict
 
 import ipaddress
 
-from .exceptions_types import EmailUndeliverableError
+from .exceptions import EmailUndeliverableError
 
 import dns.resolver
 import dns.exception
@@ -19,7 +19,7 @@ def caching_resolver(*, timeout: Optional[int] = None, cache: Any = None, dns_re
 
 
 DeliverabilityInfo = TypedDict("DeliverabilityInfo", {
-    "mx": List[Tuple[int, str]],
+    "mx": list[tuple[int, str]],
     "mx_fallback_type": Optional[str],
     "unknown-deliverability": str,
 }, total=False)
@@ -66,7 +66,7 @@ def validate_email_deliverability(domain: str, domain_i18n: str, timeout: Option
             deliverability_info["mx_fallback_type"] = None
 
         except dns.resolver.NoAnswer:
-            # If there was no MX record, fall back to an A or AAA record
+            # If there was no MX record, fall back to an A or AAAA record
             # (RFC 5321 Section 5). Check A first since it's more common.
 
             # If the A/AAAA response has no Globally Reachable IP address,

email_validator-2.4.0/email_validator/exceptions.py

@@ -0,0 +1,13 @@
+class EmailNotValidError(ValueError):
+    """Parent class of all exceptions raised by this module."""
+    pass
+
+
+class EmailSyntaxError(EmailNotValidError):
+    """Exception raised when an email address fails validation because of its form."""
+    pass
+
+
+class EmailUndeliverableError(EmailNotValidError):
+    """Exception raised when an email address fails validation because its domain name does not appear deliverable."""
+    pass

{email_validator-2.2.0 → email_validator-2.4.0}/email_validator/rfc_constants.py

@@ -36,12 +36,24 @@ DOMAIN_LITERAL_CHARS = re.compile(r"[\u0021-\u00FA\u005E-\u007E]")
 QTEXT_INTL = re.compile(r"[\u0020-\u007E\u0080-\U0010FFFF]")
 
 # Length constants
+
 # RFC 3696 + errata 1003 + errata 1690 (https://www.rfc-editor.org/errata_search.php?rfc=3696&eid=1690)
-# explains the maximum length of an email address is 254 octets.
+# explains the maximum length of an email address is 254 octets based on RFC 5321 4.5.3.1.3. A
+# maximum local part length is also given at RFC 5321 4.5.3.1.1.
+#
+# But RFC 5321 4.5.3.1 says that these (and other) limits are in a sense suggestions, and longer
+# local parts have been seen in the wild. Consequntely, the local part length is only checked
+# in "strict" mode. Although the email address maximum length is also somewhat of a suggestion,
+# I don't like the idea of having no length checks performed, so I'm leaving that to always be
+# checked.
 EMAIL_MAX_LENGTH = 254
 LOCAL_PART_MAX_LENGTH = 64
+
+# Although RFC 5321 4.5.3.1.2 gives a (suggested, see above) limit of 255 octets, RFC 1035 2.3.4 also
+# imposes a length limit (255 octets). But per https://stackoverflow.com/questions/32290167/what-is-the-maximum-length-of-a-dns-name,
+# two of those octets are taken up by the optional final dot and null root label.
 DNS_LABEL_LENGTH_LIMIT = 63  # in "octets", RFC 1035 2.3.1
-DOMAIN_MAX_LENGTH = 253  # in "octets" as transmitted, RFC 1035 2.3.4 and RFC 5321 4.5.3.1.2, and see https://stackoverflow.com/questions/32290167/what-is-the-maximum-length-of-a-dns-name
+DOMAIN_MAX_LENGTH = 253  # in "octets" as transmitted
 
 # RFC 2142
 CASE_INSENSITIVE_MAILBOX_NAMES = [

{email_validator-2.2.0 → email_validator-2.4.0}/email_validator/syntax.py

@@ -1,4 +1,5 @@
-from .exceptions_types import EmailSyntaxError, ValidatedEmail
+from .exceptions import EmailSyntaxError
+from .types import ValidatedEmail
 from .rfc_constants import EMAIL_MAX_LENGTH, LOCAL_PART_MAX_LENGTH, DOMAIN_MAX_LENGTH, \
     DOT_ATOM_TEXT, DOT_ATOM_TEXT_INTL, ATEXT_RE, ATEXT_INTL_DOT_RE, ATEXT_HOSTNAME_INTL, QTEXT_INTL, \
     DNS_LABEL_LENGTH_LIMIT, DOT_ATOM_TEXT_HOSTNAME, DOMAIN_NAME_REGEX, DOMAIN_LITERAL_CHARS
@@ -7,12 +8,12 @@ import re
 import unicodedata
 import idna  # implements IDNA 2008; Python's codec is only IDNA 2003
 import ipaddress
-from typing import Optional, Tuple, TypedDict, Union
+from typing import Optional, TypedDict
 
 
-def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
-    # Return the display name, unescaped local part, and domain part
-    # of the address, and whether the local part was quoted. If no
+def split_email(email: str) -> tuple[Optional[str], str, str, bool, str]:
+    # Return the display name, the original local part, the unescaped
+    # local part, and the domain part of the address. If no
     # display name was present and angle brackets do not surround
     # the address, display name will be None; otherwise, it will be
     # set to the display name or the empty string if there were
@@ -35,7 +36,7 @@ def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
     #
     # Display names are either basic characters (the same basic characters
     # permitted in email addresses, but periods are not allowed and spaces
-    # are allowed; see RFC 5322 Appendix A.1.2), or or a quoted string with
+    # are allowed; see RFC 5322 Appendix A.1.2), or a quoted string with
     # the same rules as a quoted local part. (Multiple quoted strings might
     # be allowed? Unclear.) Optional space (RFC 5322 3.4 CFWS) and then the
     # email address follows in angle brackets.
@@ -46,7 +47,7 @@ def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
     # We assume the input string is already stripped of leading and
     # trailing CFWS.
 
-    def split_string_at_unquoted_special(text: str, specials: Tuple[str, ...]) -> Tuple[str, str]:
+    def split_string_at_unquoted_special(text: str, specials: tuple[str, ...]) -> tuple[str, str]:
         # Split the string at the first character in specials (an @-sign
         # or left angle bracket) that does not occur within quotes and
         # is not followed by a Unicode combining character.
@@ -57,10 +58,17 @@ def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
         for i, c in enumerate(text):
             # < plus U+0338 (Combining Long Solidus Overlay) normalizes to
             # ≮ U+226E (Not Less-Than), and  it would be confusing to treat
-            # the < as the start of "<email>" syntax in that case. Liekwise,
+            # the < as the start of "<email>" syntax in that case. Likewise,
             # if anything combines with an @ or ", we should probably not
             # treat it as a special character.
-            if unicodedata.normalize("NFC", text[i:])[0] != c:
+            #
+            # Only the characters right after c can combine with it, so
+            # look at a short window rather than normalizing the rest of
+            # the string at every position, which is quadratic in the
+            # length of the input. The window is c, the 30 combining
+            # characters in a row allowed by the Unicode Stream-Safe Text
+            # Format (UAX #15), and one more character.
+            if unicodedata.normalize("NFC", text[i:i + 32])[0] != c:
                 left_part += c
 
             elif inside_quote:
@@ -82,7 +90,28 @@ def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
             else:
                 left_part += c
 
+        # No special symbol found. The special symbols always
+        # include an at-sign, so this always indicates a missing
+        # at-sign. The other symbol is optional.
         if len(left_part) == len(text):
+            # The full-width at-sign might occur in CJK contexts.
+            # We can't accept it because we only accept addresess
+            # that are actually valid. But if this is common we
+            # may want to consider accepting and normalizing full-
+            # width characters for the other special symbols (and
+            # full-width dot is already accepted in internationalized
+            # domains) with a new option.
+            # See https://news.ycombinator.com/item?id=42235268.
+            if "＠" in text:
+                raise EmailSyntaxError("The email address has the \"full-width\" at-sign (@) character instead of a regular at-sign.")
+
+            # Check another near-homoglyph for good measure because
+            # homoglyphs in place of required characters could be
+            # very confusing. We may want to consider checking for
+            # homoglyphs anywhere we look for a special symbol.
+            if "﹫" in text:
+                raise EmailSyntaxError('The email address has the "small commercial at" character instead of a regular at-sign.')
+
             raise EmailSyntaxError("An email address must have an @-sign.")
 
         # The right part is whatever is left.
@@ -90,7 +119,7 @@ def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
 
         return left_part, right_part
 
-    def unquote_quoted_string(text: str) -> Tuple[str, bool]:
+    def unquote_quoted_string(text: str) -> tuple[str, bool]:
         # Remove surrounding quotes and unescape escaped backslashes
         # and quotes. Escapes are parsed liberally. I think only
         # backslashes and quotes can be escaped but we'll allow anything
@@ -156,7 +185,7 @@ def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
             raise EmailSyntaxError("There can't be anything after the email address.")
 
         # Remove the initial and trailing angle brackets.
-        addr_spec = right_part[1:].rstrip(">")
+        addr_spec = right_part[1:-1]
 
         # Split the email address at the first unquoted @-sign.
         local_part, domain_part = split_string_at_unquoted_special(addr_spec, ("@",))
@@ -171,9 +200,9 @@ def split_email(email: str) -> Tuple[Optional[str], str, str, bool]:
         domain_part = domain_part[1:]
 
     # Unquote the local part if it is quoted.
-    local_part, is_quoted_local_part = unquote_quoted_string(local_part)
+    local_part_unquoted, is_quoted_local_part = unquote_quoted_string(local_part)
 
-    return display_name, local_part, domain_part, is_quoted_local_part
+    return display_name, local_part, local_part_unquoted, is_quoted_local_part, domain_part
 
 
 def get_length_reason(addr: str, limit: int) -> str:
@@ -207,7 +236,7 @@ class LocalPartValidationResult(TypedDict):
 
 
 def validate_email_local_part(local: str, allow_smtputf8: bool = True, allow_empty_local: bool = False,
-                              quoted_local_part: bool = False) -> LocalPartValidationResult:
+                              quoted_local_part: bool = False, strict: bool = False) -> LocalPartValidationResult:
     """Validates the syntax of the local part of an email address."""
 
     if len(local) == 0:
@@ -229,7 +258,7 @@ def validate_email_local_part(local: str, allow_smtputf8: bool = True, allow_emp
     # internationalized, then the UTF-8 encoding may be longer, but
     # that may not be relevant. We will check the total address length
     # instead.
-    if len(local) > LOCAL_PART_MAX_LENGTH:
+    if strict and len(local) > LOCAL_PART_MAX_LENGTH:
         reason = get_length_reason(local, limit=LOCAL_PART_MAX_LENGTH)
         raise EmailSyntaxError(f"The email address is too long before the @-sign {reason}.")
 
@@ -280,8 +309,8 @@ def validate_email_local_part(local: str, allow_smtputf8: bool = True, allow_emp
         valid = "dot-atom"
         requires_smtputf8 = True
 
-    # There are no syntactic restrictions on quoted local parts, so if
-    # it was originally quoted, it is probably valid. More characters
+    # There are no dot-atom syntax restrictions on quoted local parts, so
+    # if it was originally quoted, it is probably valid. More characters
     # are allowed, like @-signs, spaces, and quotes, and there are no
     # restrictions on the placement of dots, as in dot-atom local parts.
     elif quoted_local_part:
@@ -438,6 +467,36 @@ def check_dot_atom(label: str, start_descr: str, end_descr: str, is_hostname: bo
             raise EmailSyntaxError("An email address cannot have a period and a hyphen next to each other.")
 
 
+def uts46_valid_char(char: str) -> bool:
+    # By exhaustively searching for characters rejected by
+    # for c in (chr(i) for i in range(0x110000)):
+    #   idna.uts46_remap(c, std3_rules=False, transitional=False)
+    # I found the following rules are pretty close.
+    c = ord(char)
+    if 0x80 <= c <= 0x9f:
+        # 8-bit ASCII range.
+        return False
+    elif ((0x2010 <= c <= 0x2060 and not (0x2024 <= c <= 0x2026) and not (0x2028 <= c <= 0x202E))
+          or c in (0x00AD, 0x2064, 0xFF0E)
+          or 0x200B <= c <= 0x200D
+          or 0x1BCA0 <= c <= 0x1BCA3):
+        # Characters that are permitted but fall into one of the
+        # tests below.
+        return True
+    elif unicodedata.category(chr(c)) in ("Cf", "Cn", "Co", "Cs", "Zs", "Zl", "Zp"):
+        # There are a bunch of Zs characters including regular space
+        # that are allowed by UTS46 but are not allowed in domain
+        # names anyway.
+        #
+        # There are some Cn (unassigned) characters that the idna
+        # package doesn't reject but we can, I think.
+        return False
+    elif "002E" in unicodedata.decomposition(chr(c)).split(" "):
+        # Characters that decompose into a sequence with a dot.
+        return False
+    return True
+
+
 class DomainNameValidationResult(TypedDict):
     ascii_domain: str
     domain: str
@@ -446,6 +505,14 @@ class DomainNameValidationResult(TypedDict):
 def validate_email_domain_name(domain: str, test_environment: bool = False, globally_deliverable: bool = True) -> DomainNameValidationResult:
     """Validates the syntax of the domain part of an email address."""
 
+    # A domain can get shorter through normalization (either from IDNA decoding or Unicode normalization),
+    # but the caller may use the original input, so the length check can apply up front. We also get a
+    # less helpful error via idna.uts46_remap and would rather do it ourselves. And it's important to
+    # prevent a DOS attack via idna: See below.
+    if len(domain) > DOMAIN_MAX_LENGTH:
+        reason = get_length_reason(domain, limit=DOMAIN_MAX_LENGTH)
+        raise EmailSyntaxError(f"The email address is too long after the @-sign {reason}.")
+
     # Check for invalid characters.
     # (RFC 952 plus RFC 6531 section 3.3 for internationalized addresses)
     bad_chars = {
@@ -462,6 +529,15 @@ def validate_email_domain_name(domain: str, test_environment: bool = False, glob
     # they may not be valid, safe, or sensible Unicode strings.
     check_unsafe_chars(domain)
 
+    # Reject characters that would be rejected by UTS-46 normalization next but
+    # with an error message under our control.
+    bad_chars = {
+        safe_character_display(c) for c in domain
+        if not uts46_valid_char(c)
+    }
+    if bad_chars:
+        raise EmailSyntaxError("The part after the @-sign contains invalid characters: " + ", ".join(sorted(bad_chars)) + ".")
+
     # Perform UTS-46 normalization, which includes casefolding, NFC normalization,
     # and converting all label separators (the period/full stop, fullwidth full stop,
     # ideographic full stop, and halfwidth ideographic full stop) to regular dots.
@@ -518,6 +594,14 @@ def validate_email_domain_name(domain: str, test_environment: bool = False, glob
         # doesn't give a nice error, so we call the underlying idna.alabel method
         # directly. idna.alabel checks label length and doesn't give great messages,
         # but we can't easily go to lower level methods.
+        #
+        # idna.encode also rejects a domain that is too long before it looks
+        # at any label, because checking or decoding a long label can take time
+        # quadratic in its length (a long Punycode "xn--" label, or, before idna
+        # 3.15, a long run of Arabic-Indic digits). Since we call idna.alabel
+        # directly, check the length first above. A label never gets shorter
+        # when it is converted to IDNA ASCII, so a domain this long would fail
+        # the length check below anyway.
         try:
             ascii_domain = ".".join(
                 idna.alabel(label).decode("ascii")
@@ -583,6 +667,13 @@ def validate_email_domain_name(domain: str, test_environment: bool = False, glob
         if ascii_domain == d or ascii_domain.endswith("." + d):
             raise EmailSyntaxError("The part after the @-sign is a special-use or reserved name that cannot be used with email.")
 
+    # Domains without Punycode labels come back unchanged from the IDNA round trip below.
+    if "xn--" not in ascii_domain:
+        return {
+            "ascii_domain": ascii_domain,
+            "domain": ascii_domain,
+        }
+
     # We may have been given an IDNA ASCII domain to begin with. Check
     # that the domain actually conforms to IDNA. It could look like IDNA
     # but not be actual IDNA. For ASCII-only domains, the conversion out
@@ -607,12 +698,26 @@ def validate_email_domain_name(domain: str, test_environment: bool = False, glob
     # case for this.
     bad_chars = {
         safe_character_display(c)
-        for c in domain
+        for c in domain_i18n
         if not ATEXT_HOSTNAME_INTL.match(c)
     }
     if bad_chars:
         raise EmailSyntaxError("The part after the @-sign contains invalid characters: " + ", ".join(sorted(bad_chars)) + ".")
-    check_unsafe_chars(domain)
+    check_unsafe_chars(domain_i18n)
+
+    # If any label has right-to-left characters, the Bidi Rule applies to
+    # every label in the domain, including left-to-right ones (RFC 5893
+    # Section 1.4 and 2, UTS #46 CheckBidi). The idna package only checks
+    # each label on its own, so a label like "1" next to a right-to-left
+    # label was accepted, and such domains can be displayed identically to
+    # a different domain (e.g. 1.xn--4dbc.com and xn--4dbc.1.com, which
+    # are 1.אב.com and אב.1.com in Unicode, with Hebrew alef bet).
+    if any(unicodedata.bidirectional(c) in ("R", "AL", "AN") for c in domain_i18n):
+        for label in domain_i18n.split("."):
+            try:
+                idna.check_bidi(label, check_ltr=True)
+            except idna.IDNAError as e:
+                raise EmailSyntaxError(f"The part after the @-sign is not valid IDNA ({e}).") from e
 
     # Check that it can be encoded back to IDNA ASCII. We have no test
     # case for this.
@@ -642,7 +747,7 @@ def validate_email_length(addrinfo: ValidatedEmail) -> None:
     #    form is checked first because it is the original input.
     # 2) The normalized email address. We perform Unicode NFC normalization of
     #    the local part, we normalize the domain to internationalized characters
-    #    (if originaly IDNA ASCII) which also includes Unicode normalization,
+    #    (if originally IDNA ASCII) which also includes Unicode normalization,
     #    and we may remove quotes in quoted local parts. We recommend that
     #    callers use this string, so it must be valid.
     # 3) The email address with the IDNA ASCII representation of the domain
@@ -697,7 +802,7 @@ def validate_email_length(addrinfo: ValidatedEmail) -> None:
 
 
 class DomainLiteralValidationResult(TypedDict):
-    domain_address: Union[ipaddress.IPv4Address, ipaddress.IPv6Address]
+    domain_address: ipaddress.IPv4Address | ipaddress.IPv6Address
     domain: str
 
 
@@ -706,7 +811,7 @@ def validate_email_domain_literal(domain_literal: str) -> DomainLiteralValidatio
     # a compressed/normalized address.
     # RFC 5321 4.1.3 and RFC 5322 3.4.1.
 
-    addr: Union[ipaddress.IPv4Address, ipaddress.IPv6Address]
+    addr: ipaddress.IPv4Address | ipaddress.IPv6Address
 
     # Try to parse the domain literal as an IPv4 address.
     # There is no tag for IPv4 addresses, so we can never
@@ -723,13 +828,18 @@ def validate_email_domain_literal(domain_literal: str) -> DomainLiteralValidatio
             "domain": f"[{addr}]",
         }
 
-    # If it begins with "IPv6:" it's an IPv6 address.
-    if domain_literal.startswith("IPv6:"):
+    # If it begins with "IPv6:" it's an IPv6 address. The tag is case-insensitive
+    # like all ABNF literal strings (RFC 5234 2.3), so "ipv6:" is accepted too.
+    if domain_literal[:5].lower() == "ipv6:":
         try:
             addr = ipaddress.IPv6Address(domain_literal[5:])
         except ValueError as e:
             raise EmailSyntaxError(f"The IPv6 address in brackets after the @-sign is not valid ({e}).") from e
 
+        # Python accepts a zone index ("%eth0") but RFC 5321 4.1.3 does not.
+        if addr.scope_id is not None:
+            raise EmailSyntaxError("The IPv6 address in brackets after the @-sign is not valid (It has a zone index).")
+
         # Return the IPv6Address object and construct a normalized
         # domain literal.
         return {