Spec the email check on a public sign-up endpoint

Your sign-up endpoint runs on Node, and its email check turns away real customers: addresses with a + tag, new long domains such as .photography, and names with an apostrophe. You will have an agent replace the check.

Write the spec you would hand the agent.

What you know:

• the check runs on every POST /signup, which is public and needs no sign-in
• every new account already gets a confirmation email with a link
• the database column holds up to 254 characters
• marketing wants to catch obvious typos, such as name@gmail with no dot

Then, in a few sentences: what does "write a regex to validate emails" tend to produce, and why is it risky here?