RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-domain

error-invalid-domain

Error message

The email domain is not in whitelist

What it means

After syntactic validation, validateEmailDomain() compares the address's domain (text after the last '@') against Accounts_Domain_Whitelist; a non-empty whitelist that does not include the domain throws error-invalid-domain. An empty whitelist disables the restriction entirely. The setting is comma-separated and each entry is trimmed when loaded.

Source

Thrown at apps/meteor/server/lib/validateEmailDomain.js:49

	emailDomainWhiteList = value
		.split(',')
		.filter(Boolean)
		.map((domain) => domain.trim());
});

export const validateEmailDomain = async function (email) {
	if (!validateEmail(email)) {
		throw new Meteor.Error('error-invalid-email', `Invalid email ${email}`, {
			function: 'RocketChat.validateEmailDomain',
			email,
		});
	}

	const emailDomain = email.substr(email.lastIndexOf('@') + 1);

	if (emailDomainWhiteList.length && !emailDomainWhiteList.includes(emailDomain)) {
		throw new Meteor.Error('error-invalid-domain', 'The email domain is not in whitelist', {
			function: 'RocketChat.validateEmailDomain',
		});
	}
	if (
		emailDomainBlackList.length &&
		(emailDomainBlackList.indexOf(emailDomain) !== -1 ||
			(settings.get('Accounts_UseDefaultBlockedDomainsList') && emailDomainDefaultBlackList.indexOf(emailDomain) !== -1))
	) {
		throw new Meteor.Error('error-email-domain-blacklisted', 'The email domain is blacklisted', {
			function: 'RocketChat.validateEmailDomain',
		});
	}

	if (settings.get('Accounts_UseDNSDomainCheck')) {
		try {
			await dnsResolveMx(emailDomain);
		} catch (e) {
			throw new Meteor.Error('error-invalid-domain', 'Invalid domain', {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Add the exact domain (lowercase, no '@', no spaces) to Accounts_Domain_Whitelist and retry.
2. If the restriction is unintended, clear Accounts_Domain_Whitelist — empty disables the check.
3. Re-check case and hidden whitespace in both the setting and the submitted address.

Example fix

// before: Accounts_Domain_Whitelist = "corp.com" -> user@partner.com rejected
await validateEmailDomain('user@partner.com');

// after: include the partner domain in the setting
// Admin > General > Accounts_Domain_Whitelist = "corp.com,partner.com"
await validateEmailDomain('user@partner.com');

const isAllowedEmailDomain = (email: string, whitelist: string[]): boolean => {
  const domain = email.slice(email.lastIndexOf('@') + 1).toLowerCase();
  return whitelist.length === 0 || whitelist.map((d) => d.trim().toLowerCase()).includes(domain);
};

try {
  await validateEmailDomain(email);
} catch (err: any) {
  if (err?.error === 'error-invalid-domain' && err?.reason?.includes('whitelist')) {
    // tell the admin which domain must be added to Accounts_Domain_Whitelist
    return reportDomainNotAllowed(email.slice(email.lastIndexOf('@') + 1));
  }
  throw err;
}

When it happens

Trigger: Accounts_Domain_Whitelist set to 'corp.com,partner.com' and inviting user@other.com; exact-match failures from case differences ('Corp.com' vs 'corp.com') or stray spaces in the setting; whitelist enabled on a server where admins assumed it was off.

Common situations: Onboarding partners/contractors whose domains were never whitelisted; typos or casing issues in the admin setting; confusion between whitelist (allow-mode) and blacklist semantics.

Related errors

• error-email-domain-blacklisted
• CustomOAuth: emailPath is required
• error-invalid-from-address
• error-email-send-failed
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/ede7e58f9d03c81a. Report an issue: GitHub.