Anything you can send an email to that is received, as far as I am concerned. I have my own domain, so why ahould I be forced to add an arbitrarily long string to it to be able to receive the mail? Or exclude <site>@myDomain.com from being input on <site>?

Or the worst of the worst: Disallow all but a few domains for emails.

At this point, not validating it cient side at all is IMO the correct approach, and instead send a verification email.

100% this.

The only acceptable hard validation is to check whether there is an @ between some characters. something like `.@.` in regex.

It makes sense to do sanity checking (soft validation) on client side. There is 99.9% chance that `[email protected]` is wrong, outright rejecting that is wrong, though.