113

Here is an extracted portion of my query, reflecting the EMAIL_ADDRESS column data type and property:

EMAIL_ADDRESS CHARACTER VARYING(20) NOT NULL,

However, John Saunders uses VARYING(256).

This suggests me that I have not necessarily understood the VARYING correctly.

I understand it such that the length of an email address is 20 characters in my case, while 256 for Jodn.

Context in John's code

CREATE TABLE so."User" ( USER_ID SERIAL NOT NULL, USER_NAME CHARACTER VARYING(50) NOT NULL, EMAIL_ADDRESS CHARACTER VARYING(256) NOT NULL, // Here HASHED_PASSWORD so.HashedPassword NOT NULL, OPEN_ID CHARACTER VARYING(512), A_MODERATOR BOOLEAN, LOGGED_IN BOOLEAN, HAS_BEEN_SENT_A_MODERATOR_MESSAGE BOOLEAN, CONSTRAINT User_PK PRIMARY KEY(USER_ID) );

I have never seen email addresses longer than 20 characters, used by ordinary people.

What is the optimal length for an email address in a database?

Improve this question
8
  • What do you mean by "optimal"? What are you trying to "optimize"? Commented Jul 29, 2009 at 10:34
  • 1
    @S.Lott: I want build a secure system. The increase in user's input increases the risk that they can run codes in the database. --- I see optimal as the best way to have a secure system. Commented Jul 29, 2009 at 10:40
  • 1
    Well, while there is security considerations in not making something unbounded, adhearing to the standards will always make the most sense. Following what is "common" or "optimal" will likely introduce security issues then reduce them. Commented Jul 29, 2009 at 11:39
  • 1
    This question on StackOverflow suggests that the max length is now 254 characters including the "@" sign: stackoverflow.com/questions/386294/… Commented Feb 11, 2010 at 16:35
  • 1
    Here's a related post on email length from @DominicSayers, with a really thorough answer: stackoverflow.com/a/574698/361842 Commented Jul 28, 2017 at 9:25

9 Answers 9

Reset to default
167

The maximum length of an email address is 254 characters.

Every email address is composed of two parts. The local part that comes before the '@' sign, and the domain part that follows it. In "[email protected]", the local part is "user", and the domain part is "example.com".

The local part must not exceed 64 characters and the domain part cannot be longer than 255 characters.

The combined length of the local + @ + domain parts of an email address must not exceed 254 characters. As described in RFC3696 Errata ID 1690.

I got the original part of this information from here

Improve this answer
Sign up to request clarification or add additional context in comments.

5 Comments

It seems that it is the best to take 320 as the length.
I know this is an old thread and there's no problem using 320, but the actual maximum is 254 because of an overriding restriction from RFC2821 that imposes additional constraints over and above those quoted for the local and domain parts. If storage space is an issue, this may be worth people knowing if they stumble on this thread. See Errata ID 1690 in errata to RFC3696
As @flightplanner said, Wikipedia summarizes those sections here: "but the maximum...restricts the entire email address to be no more than 254 characters"
Especially if you want the email field to have a unique constraint; under INNODB and utf8 varchar(254) is small enough (less than 767bytes) to have a unique constraint and varchar(300) is not.
In the RFC 3696 errata ID 1003 I found it says that 256 chars is the practical limit (and 320 chars the maximum).
59

from Ask Metafilter:

My data comes from a database of 323 addresses. The distribution has some upper-end outliers (positively-skewed). It is normally distributed without the outliers (I tested it.)

Min: 12 1st quartile: 19 Mean (w/ outliers): 23.04 Mean w/o outliers): 22.79 3rd quartile: 26 Max (w/ outliers): 47 Max (w/o outliers): 35

Median: 23 Mode: 24 Std. Dev (w/ outliers): 5.20 Std. Dev (w/o outliers): 4.70

Ranges based on data including outliers 68.2% of data 17.8 - 28.2 95.4% of data 12.6 - 33.4 99.7% of data 7.4 - 38.6

Ranges based on data outliers excluded 68.2% of data 18.1 - 27.5 95.4% of data 13.4 - 32.2 99.7% of data 8.7 - 36.9

If you sign up for http://www.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijk.com/ then your email address would surely be an outlier :)

Here's What is the maximum safe length of an email address to allow in a website form? on Raycon with a slightly different mean (N=50,496, mean=23):

Email address length distribution

Improve this answer

6 Comments

@Masi actually what's curious is that it's a Poisson distribution rather than a normal distribution - anyone have ideas why it's like that? :P
@pageman: The reason is that each event is randomly distributed AND each event is taken from the infinity space. - You get a similar distribution if you calculate the number of cars driving to RED such that you have time vs. number of cars driving to red in the axes.
Personally I like Benford's Law better: en.wikipedia.org/wiki/Benford%27s_law
I've used 120 variable characters for years. The real world logic is that even if someone is ready to fill your 320 varchar field...I bet they have a 40 char alternative email just standing by
The link abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijk… seems to be spam now - potentially dangerous. would not click.
|
27

Just use varchar(50). Longer emails are crap, every time.

Just look how long 50 chars is:

peoplewithanemail@ddressthislongjustuseashorterone

If you allow 255 character emails:

  • Displaying them can mess up your UI (at best they will be cut off, at worst they push your containers and margins around) and
  • Malicious users can do things with them you can't anticipate (like those cases where hackers used a free online API to store a bunch of data)

(Statistics show that no-one actually enters more than about 50 chars for a legit email address, see e.g.: pageman's answer https://stackoverflow.com/a/1199245/87861)

Improve this answer

6 Comments

Totally agree. Who in their right mind would have an email address any longer? Sure, it is theoretically correct that an email can be 320 chars but in the real world? In my systems I also use varchar(50) and I have never had a complaint that a user cannot register.
It would be interesting to know from huge datasets what the average real world email length is and what the outliers are and how big.
Wrong. There are plenty of real-world users who have more than 50 characters in their email, and more importantly they can't change it just for you. Refusing them access for something they can't fix is unfair.
they can make new emails of course they can. make google one.
Also, don’t forget about the plus notation. Some power users are using this to segregate and organize their emails in their inbox. Essentially, they’ll have a unique (sub-)email per each website/service/app. For example, let’s imagine that my normal email is my first name and last name at some company name: [email protected]. That’s already ~40 characters. Now, if I used a plus notation for a stackoverflow account: [email protected]—that’s ~55 characters. Some plus notations may be longer, e.g., +stackoverflow-personal and *-work.
|
18

My work email address is more than 20 characters!

Read the appropriate RFC specification:

"The local-part of an e-mail address may be up to 64 characters long and the domain name may have a maximum of 255 characters"

Improve this answer

Comments

5

Variable character types in databases don't occupy unneeded space. Thus, there is no reason to constrain such fields as much as possible. Depending on the name of a person, the naming scheme used by their organization and their domain name, an address can easily exceed 20 characters.

There is no limit as to the length of local-part and domain-name in RFC-2822. RFC-2181 limits the domain name to 255 octets/characters though.

Again, since a varchar only uses the space actually used by the string you store, there is no reason to have a small limit for email address length. Just go with 512 and stop worrying. Everything else is premature optimization

Improve this answer

Comments

3

Initially the maximum is 320 characters (64+1+255, as show in other answers) but as RFC 3696 Errata 1003 said:

However, there is a restriction in RFC 2821 on the length of an address in MAIL and RCPT commands of 256 characters. Since addresses that do not fit in those fields are not normally useful, the upper limit on address lengths should normally be considered to be 256.

And from RFC 5321 section 4.5.3.1.3:

4.5.3.1.3. Path

The maximum total length of a reverse-path or forward-path is 256 octets (including the punctuation and element separators)

This is including the opening and closing brackets so it let us to only 254 octets of email address.

But get in mind that the number of octets may not be equal to the numbers of characters (a char may have 2 or more octets). Also the RFC section 4.5.3.1 tell that there can be fields of more that the maximum and this is possible but not guarantied to servers to catch they correctly.

And then you can/must use a VARCHAR(254) to store an email address.

Note: In MySQL at least, a column declared as VARCHAR whit less or equal than 255 octets will be all stored as 1 byte + length (the 1 is to store the length) so no space is gained if used a lower limit.

Improve this answer

1 Comment

You fail to explain how you go from 256 bytes to 254. I know this is the result of the opening/closing brackets, but you should explain this as part of the answer.
3

TLDR Answer

Use a VARCHAR(256) to store the 256 character maximum entailed in current, prevailing RFC Internet standards.

Source

SMTP originally defined what a path was in RFC821, published August 1982, which is an official Internet Standard (most RFC's are only proposals). To quote it...

...a reverse-path, specifies who the mail is from.

...a forward-path, which specifies who the mail is to.

RFC2821, published in April 2001, is the Obsoleted Standard that defined our present maximum values for local-parts, domains, and paths. A new Draft Standard, RFC5321, published in October 2008, keeps the same limits. To quote RFC2821...

4.5.3.1.3. Path

The maximum total length of a reverse-path or forward-path is 256 characters (including the punctuation and element separators).

Common Mistaken Answers

In February 2004, RFC3696 was published and it mistakenly cites the max limit of email addresses as 320 characters. But this was an "informational-only" document, which states...

"This memo provides information for the Internet community. It does not specify an Internet standard of any kind."

We can disregard this limit, then, as it is published before RFC5321, which is a Draft Internet Standard that keeps the email address max limit unchanged at 256 characters.

Improve this answer

Comments

1

As others have said, way bigger than 20. 256 + 64 sounds good to me, and is RFC compliant.

The only reason to not have such a large value for your database is if you are worrying about performance or space, and if you are doing that then I'm 99.99999999999999% sure that is premature optimization.

Go big.

Improve this answer

3 Comments

VARCHAR only stored the number of characters needed (plus the length). Only issue I see is if you are fighting for space in the 8000 byte per row limit.
I am not fighting for space. I am fighting for the balance between security and usability.
There is no balance between security and usability when there is no usability.
1

A CHAR(20) field will always take up 20 characters, whether you use it all or not. (Often padded with spaces at the end.) A VARCHAR(20) field will take up up to 20 characters, but may take up less. One benefit of CHAR()s constant width is fast jumping to a row in a table, because you can just calculate the index it must be on. The drawback is wasting space.

The benefit of constant-sized CHAR(x)'s is lost if you have any VARCHAR(x) columns in your table. I seem to recall that MySQL silently converted any CHAR() fields into VARCHAR() behind the scenes if some columns were VARCHAR()s.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.