What is allowed in emails addresses is defined by RFC822 and superceded by RFC2822.
Use the Mythic Beasts email RFC822 validation website if you need to do a quick check.
The wikipedia also has a very human readable description of what is allowed for email addresses.
Has good links to code samples - http://blog.badsyntax.co/post/2892776925/javascript-email-validation-rfc822