A before-save Apex trigger on the Lead object is the most robust and efficient solution. This type of trigger executes before a record's data is committed to the database, making it the ideal place for complex, server-side validation. By using the addError() method within the trigger, the save operation can be prevented if the email address is found to be invalid. This ensures the validation logic is enforced universally, regardless of whether the lead is created through the user interface, an API integration, or a data import process, thus providing the required additional layer of validation.

1. Salesforce Apex Developer Guide

"Triggers": The guide states

"There are two types of triggers: Before triggers are used to update or validate record values before they’re saved to the database. After triggers are used to access field values that are set by the system (such as a record's Id or LastModifiedDate field)

and to affect changes in other records." This confirms that a before trigger is the correct context for validation.

2. Salesforce Apex Developer Guide

"Trigger and Order of Execution": The official order of execution documentation shows that before triggers execute after system validation rules. This aligns with the scenario of adding an "additional layer" of validation on top of an existing validation rule.

3. Salesforce Apex Reference Guide

"Exception Class and Built-In Exceptions": The documentation for the sObject.addError() method explains that its use in a trigger context prevents the DML operation from committing. This is the core mechanism for enforcing the validation requirement.