It's much worse than that. This doesn't even cover the rules for domain names, which are mapped to a subset of Unicode. Read the horrors of "Unicode IDNA Compatibility Processing".[1] This is an incredibly complicated scheme to deal with homoglyphs - characters which look the same, but are not. There's filtering for specific characters that look the same. There's detection of mixed left-to-right and right-to-left characters. This is all to prevent attacks where the domain name in a link looks like some trusted site, but isn't.

The "." in a domain name is no longer always a period. It can be any of

    U+002E ( . ) FULL STOP
    U+FF0E ( ． ) FULLWIDTH FULL STOP
    U+3002 ( 。 ) IDEOGRAPHIC FULL STOP
    U+FF61 ( ｡ ) HALFWIDTH IDEOGRAPHIC FULL STOP

Validating an email address is quite hard if done right.

[1] http://www.unicode.org/reports/tr46/