diff --git a/api/contact.js b/api/contact.js
index adf035d..c84eed6 100644
--- a/api/contact.js
+++ b/api/contact.js
@@ -18,7 +18,7 @@ const ROUTES = {
   partner: "hello@openral.com",
 };
 
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const EMAIL_RE = /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@(?:(?!-)[A-Za-z0-9-]{1,63}(?<!-)\.)+[A-Za-z]{2,63}$/;
 
 // Best-effort, per-instance rate limit. Vercel functions are ephemeral and
 // horizontally scaled, so this is not a hard global cap — it just blunts a
@@ -34,7 +34,7 @@ function rateLimited(ip) {
   recent.push(now);
   hits.set(ip, recent);
   if (hits.size > 5000) hits.clear(); // bound memory on a long-lived instance
-  return recent.length > RATE_LIMIT.max;
+  return recent.length >= RATE_LIMIT.max;
 }
 
 function clamp(s, n) {
@@ -75,9 +75,9 @@ export default async function handler(req, res) {
   const name = clamp(body.name, 120);
   const email = clamp(body.email, 200);
   const message = clamp(body.message, 5000);
-  const honeypot = clamp(body.company, 100); // optional anti-spam trap
+  const companyField = clamp(body.company, 100); // honeypot (anti-spam trap) field
 
-  if (honeypot) return res.status(200).json({ ok: true }); // silently drop bots
+  if (companyField) return res.status(200).json({ ok: true }); // silently drop bots
   if (!name || !email || !message) {
     return res.status(400).json({ error: "Name, email and message are required." });
   }