RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-domain

error-invalid-domain

Error message

error-invalid-domain

What it means

Thrown by Rocket.Chat's user-creation flow: validateEmailDomain (called from onCreateUserAsync) fires when the setting Accounts_AllowedDomainsList is non-empty and the new user's first email address does not end with @<domain> for any domain in that comma-separated list. The regex is anchored at the end of the address, so subdomains and partial matches fail. It protects workspaces from registrations using email domains outside the approved set.

Source

Thrown at apps/meteor/server/lib/auth/startup.js:205

const validateEmailDomain = (user) => {
	if (user.type === 'visitor') {
		return true;
	}

	let domainWhiteList = settings.get('Accounts_AllowedDomainsList');
	if (_.isEmpty(domainWhiteList?.trim())) {
		return true;
	}

	domainWhiteList = domainWhiteList.split(',').map((domain) => domain.trim());

	if (user.emails && user.emails.length > 0) {
		const email = user.emails[0].address;
		const inWhiteList = domainWhiteList.some((domain) => email.match(`@${escapeRegExp(domain)}$`));

		if (!inWhiteList) {
			throw new Meteor.Error('error-invalid-domain');
		}
	}

	return true;
};

const onCreateUserAsync = async function (options, user = {}) {
	if (!options.skipBeforeCreateUserCallback) {
		await beforeCreateUserCallback.run(options, user);
	}
	user.status = 'offline';

	user.active = user.active !== undefined ? user.active : !settings.get('Accounts_ManuallyApproveNewUsers');
	if (settings.get('Accounts_ManuallyApproveNewUsers') && !user.active) {
		user.inactiveReason = 'pending_approval';
	}

	if (!user.name) {

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Add the exact email domain (the part after @, e.g. corp.com) to Accounts_AllowedDomainsList in Administration -> Accounts -> Registration
  2. If the restriction is not intended, clear Accounts_AllowedDomainsList entirely (empty or blank disables the check)
  3. Remember the match is suffix-anchored: list each subdomain explicitly (corp.com does not cover mail.corp.com)
  4. For trusted programmatic creation (migrations/imports) pass options.skipEmailValidation = true so onCreateUserAsync skips validateEmailDomain

Example fix

// before
await createUserAccount({ email: 'dev@mail.corp.com', password, name });
// throws error-invalid-domain when whitelist only contains corp.com

// after
// workspace setting Accounts_AllowedDomainsList: 'corp.com,mail.corp.com'
// or, for a trusted server-side import:
onCreateUserAsync.call(context, { skipEmailValidation: true, ...options }, userDoc);
Defensive patterns

Strategy: validation

Validate before calling

const isEmailAllowed = (email: string, whitelistSetting: string | undefined): boolean => {
  const list = String(whitelistSetting ?? '').split(',').map((d) => d.trim()).filter(Boolean);
  if (list.length === 0) return true;
  return list.some((domain) => email.trim().toLowerCase().endsWith('@' + domain.toLowerCase()));
};

// before Accounts.createUser / registration:
if (!isEmailAllowed(email, settings.get('Accounts_AllowedDomainsList'))) {
  throw new Error('Email domain not allowed for registration');
}

Try / catch

try {
  await Accounts.createUserAsync(...);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-invalid-domain') {
    // permanent policy rejection: fix the whitelist or the email, never retry
  }
  throw e;
}

Prevention

When it happens

Trigger: Accounts.createUser (registration form), admin user creation, or SSO/auto-registration paths through Accounts.onCreateUser where user.emails[0].address does not match @domain$ for any entry of a non-blank Accounts_AllowedDomainsList.

Common situations: Admin restricts signups to corporate domains and a user registers with a public mailbox; a subdomain (mail.corp.com) is rejected because only corp.com is listed (anchored match); import/migration scripts creating users programmatically; stale whitelist entries after a company renames its domain.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/1bf8da1278797043. Report an issue: GitHub.