Yes exactly. We validate client side using typical JavaScript, and we also validate server side.

In our case, accounts may be created by third-party apps using REST JSON APIs, so we want to let the third-party app know that the email address isn't RFC-valid.