RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-email

error-invalid-email

Error message

Invalid email ${email}

What it means

validateEmailDomain() runs a syntactic check (validateEmail) on every email address handed to server flows such as user creation, invites and email changes; a malformed address (bad format, missing '@') throws error-invalid-email with the offending value in details.email. This is the first gate before the domain whitelist/blacklist/DNS checks that follow in the same function.

Source

Thrown at apps/meteor/server/lib/validateEmailDomain.js:40

		.split(',')
		.filter(Boolean)
		.map((domain) => domain.trim());
});
settings.watch('Accounts_AllowedDomainsList', (value) => {
	if (!value) {
		emailDomainWhiteList = [];
		return;
	}

	emailDomainWhiteList = value
		.split(',')
		.filter(Boolean)
		.map((domain) => domain.trim());
});

export const validateEmailDomain = async function (email) {
	if (!validateEmail(email)) {
		throw new Meteor.Error('error-invalid-email', `Invalid email ${email}`, {
			function: 'RocketChat.validateEmailDomain',
			email,
		});
	}

	const emailDomain = email.substr(email.lastIndexOf('@') + 1);

	if (emailDomainWhiteList.length && !emailDomainWhiteList.includes(emailDomain)) {
		throw new Meteor.Error('error-invalid-domain', 'The email domain is not in whitelist', {
			function: 'RocketChat.validateEmailDomain',
		});
	}
	if (
		emailDomainBlackList.length &&
		(emailDomainBlackList.indexOf(emailDomain) !== -1 ||
			(settings.get('Accounts_UseDefaultBlockedDomainsList') && emailDomainDefaultBlackList.indexOf(emailDomain) !== -1))
	) {
		throw new Meteor.Error('error-email-domain-blacklisted', 'The email domain is blacklisted', {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Validate and normalize the address before calling (trim + email regex, or a library like validator.isEmail).
2. Fix the source data (form or import file) that produced the malformed address.
3. Re-run the invite/creation once the address is corrected.

Example fix

// before
await validateEmailDomain('not-an-email');

// after
const email = 'user@example.com'.trim();
if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) throw new Error('malformed email');
await validateEmailDomain(email);

const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
const isEmailShape = (v: string): boolean => EMAIL_RE.test(v.trim());

if (!isEmailShape(email)) throw new Error(`malformed email: ${email}`);
await validateEmailDomain(email.trim());

const isWellFormedEmail = (v: unknown): v is string =>
  typeof v === 'string' && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v.trim());

try {
  await validateEmailDomain(email);
} catch (err: any) {
  if (err?.error === 'error-invalid-email') {
    // flag the specific address (err.details.email) back to the user; do not retry unchanged
    return reportInvalidAddress(err.details?.email);
  }
  throw err;
}

When it happens

Trigger: Server code passing a non-email string to RocketChat.validateEmailDomain(email); invites or user-creation calls whose address has no '@', multiple '@'s, or spaces; CSV import rows with dirty email columns reaching user creation.

Common situations: Client forms without email validation; import pipelines that never sanitize the email column; string-concatenation bugs producing addresses like 'user@@example.com'.

Related errors

• error-invalid-user
• error-invalid-user
• error-invalid-recipient
• error-invalid-email
• invalid email

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/a26fc11d14c3aa0a. Report an issue: GitHub.