RocketChat/Rocket.Chat · error · Meteor.Error

error-email-domain-blacklisted

error-email-domain-blacklisted

Error message

The email domain is blacklisted

What it means

Second gate in validateEmailDomain(): the address's domain must not appear in Accounts_Domain_BlackList, and when Accounts_UseDefaultBlockedDomainsList is enabled it must also avoid Rocket.Chat's built-in default blocked-domains list. The whole check only runs when the custom blacklist is non-empty — with an empty Accounts_Domain_BlackList even the default list is skipped. Matching is exact-string on the domain after the last '@'.

Source

Thrown at apps/meteor/server/lib/validateEmailDomain.js:58

		throw new Meteor.Error('error-invalid-email', `Invalid email ${email}`, {
			function: 'RocketChat.validateEmailDomain',
			email,
		});
	}

	const emailDomain = email.substr(email.lastIndexOf('@') + 1);

	if (emailDomainWhiteList.length && !emailDomainWhiteList.includes(emailDomain)) {
		throw new Meteor.Error('error-invalid-domain', 'The email domain is not in whitelist', {
			function: 'RocketChat.validateEmailDomain',
		});
	}
	if (
		emailDomainBlackList.length &&
		(emailDomainBlackList.indexOf(emailDomain) !== -1 ||
			(settings.get('Accounts_UseDefaultBlockedDomainsList') && emailDomainDefaultBlackList.indexOf(emailDomain) !== -1))
	) {
		throw new Meteor.Error('error-email-domain-blacklisted', 'The email domain is blacklisted', {
			function: 'RocketChat.validateEmailDomain',
		});
	}

	if (settings.get('Accounts_UseDNSDomainCheck')) {
		try {
			await dnsResolveMx(emailDomain);
		} catch (e) {
			throw new Meteor.Error('error-invalid-domain', 'Invalid domain', {
				function: 'RocketChat.validateEmailDomain',
			});
		}
	}
};

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Remove the domain from Accounts_Domain_BlackList (or fix the stale entry) and retry.
  2. If the rejection came from the built-in list, disable Accounts_UseDefaultBlockedDomainsList (accepting the abuse risk) or use an address on another domain.
  3. Prefer the whitelist flow when strict control is needed instead of piling entries onto the blacklist.

Example fix

// before: Accounts_Domain_BlackList = "mailinator.com" -> user@mailinator.com rejected
await validateEmailDomain('user@mailinator.com');

// after: drop the entry (empty custom blacklist also skips the default list)
// Admin > General > Accounts_Domain_BlackList = ""
await validateEmailDomain('user@mailinator.com');
Defensive patterns

Strategy: validation

Validate before calling

const isBlacklistedEmailDomain = (email: string, blacklist: string[], useDefaults: boolean): boolean => {
  const domain = email.slice(email.lastIndexOf('@') + 1).toLowerCase();
  if (blacklist.length && blacklist.map((d) => d.trim().toLowerCase()).includes(domain)) return true;
  return useDefaults && DEFAULT_BLOCKED_DOMAINS.has(domain);
};

Try / catch

try {
  await validateEmailDomain(email);
} catch (err: any) {
  if (err?.error === 'error-email-domain-blacklisted') {
    // distinct from the whitelist failure: suggest an alternate address or admin review
    return reportBlacklistedDomain(email);
  }
  throw err;
}

Prevention

When it happens

Trigger: Accounts_Domain_BlackList contains 'example.com' and a user is created with that domain; Accounts_UseDefaultBlockedDomainsList=true and the address uses a disposable-mail domain present in the default list; exact-match hits while subdomains are (surprisingly) allowed through.

Common situations: Anti-abuse blacklists of disposable domains that later reject legitimate users; stale entries left in the blacklist; admins expecting the default list to apply even with an empty custom blacklist.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d88726b8fbe14272. Report an issue: GitHub.