{"record":{"id":"116083dc8ec6c138","repo":"cloudflare/cloudflared","slug":"allowed-mail-rule-q-has-an-invalid-wildcard-domai","errorCode":null,"errorMessage":"allowed mail rule %q has an invalid wildcard domain","messagePattern":"allowed mail rule %q has an invalid wildcard domain","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"connection/quick_tunnel_auth_validation.go","lineNumber":25,"sourceCode":"\n\t\"golang.org/x/net/idna\"\n)\n\n// validateQuickTunnelAllowedMail validates and normalizes exact email addresses and\n// wildcard domains from one or more comma-separated values.\nfunc validateQuickTunnelAllowedMail(values []string) (emails, wildcardDomains map[string]struct{}, err error) {\n\temails, wildcardDomains = make(map[string]struct{}), make(map[string]struct{})\n\tfor i, rawEntry := range strings.Split(strings.Join(values, \",\"), \",\") {\n\t\tentry := normalizeQuickTunnelEmail(rawEntry)\n\t\tdomain, isWildcard := strings.CutPrefix(entry, \"*@\")\n\n\t\tswitch {\n\t\tcase entry == \"\":\n\t\t\treturn nil, nil, fmt.Errorf(\"allowed mail rule %d is empty\", i+1)\n\n\t\tcase isWildcard:\n\t\t\tif !isValidQuickTunnelEmailDomain(domain) {\n\t\t\t\treturn nil, nil, fmt.Errorf(\n\t\t\t\t\t\"allowed mail rule %q has an invalid wildcard domain\",\n\t\t\t\t\trawEntry,\n\t\t\t\t)\n\t\t\t}\n\t\t\twildcardDomains[domain] = struct{}{}\n\n\t\tdefault:\n\t\t\tif !isValidQuickTunnelEmail(entry) {\n\t\t\t\treturn nil, nil, fmt.Errorf(\n\t\t\t\t\t\"allowed mail rule %q is not a valid email address\",\n\t\t\t\t\trawEntry,\n\t\t\t\t)\n\t\t\t}\n\t\t\temails[entry] = struct{}{}\n\t\t}\n\t}\n\n\treturn emails, wildcardDomains, nil","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/connection/quick_tunnel_auth_validation.go#L7-L43","documentation":"Wildcard entries in the allowed-mail list must be of the form \"*@<domain>\" where <domain> passes isValidQuickTunnelEmailDomain. If a \"*@\"-prefixed entry has an invalid domain (empty, malformed, no valid TLD structure), the validator returns \"allowed mail rule %q has an invalid wildcard domain\" quoting the raw entry. It rejects bad wildcards up front rather than letting them silently match nothing.","triggerScenarios":"An entry like \"*@\", \"*@domain with spaces\", \"*@-bad-.com\", or otherwise malformed domain after the \"*@\" prefix appears in the allowed mail rules.","commonSituations":"Admins writing \"*@company\" (missing TLD) or \"*@\" (missing domain entirely) in quick-tunnel access config; copy-paste errors from documentation examples.","solutions":["Use the full valid domain form: \"*@example.com\"","Remove the wildcard entry if wildcard matching is not intended and list explicit emails instead","Check isValidQuickTunnelEmailDomain's rules (no spaces, non-empty, proper domain form) and fix the domain accordingly","Escape or quote the value in config files if shell/env processing is stripping characters"],"exampleFix":"// before\nallowedMail: \"*@\"\n// after\nallowedMail: \"*@example.com\"","handlingStrategy":"validation","validationCode":"func validWildcard(entry string) bool {\n\tdomain, ok := strings.CutPrefix(entry, \"*@\")\n\treturn ok && domain != \"\" && !strings.ContainsAny(domain, \" \") &&\n\t\tstrings.Contains(domain, \".\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write wildcards as \"*@example.com\" with a full domain including TLD","Never use bare \"*@\" or domains with spaces","Test config parsing locally before deploying wildcard rules"],"tags":["go","config","validation","email","wildcard"],"backgroundTag":"invalid-argument-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}