diff --git a/gerrit-server/BUCK b/gerrit-server/BUCK
index 091c9b7..35b0ff8 100644
--- a/gerrit-server/BUCK
+++ b/gerrit-server/BUCK
@@ -53,6 +53,7 @@
     '//lib/commons:dbcp',
     '//lib/commons:lang',
     '//lib/commons:net',
+    '//lib/commons:validator',
     '//lib/guice:guice',
     '//lib/guice:guice-assistedinject',
     '//lib/guice:guice-servlet',
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateAccount.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateAccount.java
index 3b03c3a..a01c0ae 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateAccount.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateAccount.java
@@ -43,6 +43,8 @@
 import com.google.inject.Inject;
 import com.google.inject.assistedinject.Assisted;
 
+import org.apache.commons.validator.routines.EmailValidator;
+
 import java.util.Collections;
 import java.util.List;
 import java.util.Set;
@@ -121,10 +123,14 @@
       throw new ResourceConflictException(
           "username '" + username + "' already exists");
     }
-    if (input.email != null
-        && db.accountExternalIds().get(getEmailKey(input.email)) != null) {
-      throw new UnprocessableEntityException(
-          "email '" + input.email + "' already exists");
+    if (input.email != null) {
+      if (db.accountExternalIds().get(getEmailKey(input.email)) != null) {
+        throw new UnprocessableEntityException(
+            "email '" + input.email + "' already exists");
+      }
+      if (!EmailValidator.getInstance().isValid(input.email)) {
+        throw new BadRequestException("invalid email address");
+      }
     }
 
     try {
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateEmail.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateEmail.java
index 675ab96..9e78e23 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateEmail.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/CreateEmail.java
@@ -35,6 +35,7 @@
 import com.google.inject.Provider;
 import com.google.inject.assistedinject.Assisted;
 
+import org.apache.commons.validator.routines.EmailValidator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -99,6 +100,10 @@
       throw new BadRequestException("email address must match URL");
     }
 
+    if (!EmailValidator.getInstance().isValid(email)) {
+      throw new BadRequestException("invalid email address");
+    }
+
     if (input.noConfirmation
         && !self.get().getCapabilities().canAdministrateServer()) {
       throw new AuthException("must be administrator to use no_confirmation");
diff --git a/lib/commons/BUCK b/lib/commons/BUCK
index 6f412e4..c61ebce 100644
--- a/lib/commons/BUCK
+++ b/lib/commons/BUCK
@@ -76,6 +76,13 @@
 )
 
 maven_jar(
+  name = 'validator',
+  id = 'commons-validator:commons-validator:1.4.0',
+  sha1 = '42fa1046955ade59f5354a1876cfc523cea33815',
+  license = 'Apache2.0',
+)
+
+maven_jar(
   name = 'httpclient',
   id = 'org.apache.httpcomponents:httpclient:4.2.5',
   bin_sha1 = '666e26e76f2e87d84e4f16acb546481ae1b8e9a6',