{"record":{"id":"7efb7cd71059529f","repo":"toeverything/AFFiNE","slug":"invalid-email-7efb7c","errorCode":"invalid_email","errorMessage":"An invalid email provided: ${email}","messagePattern":"An invalid email provided: (.+?)","errorType":"exception","errorClass":"InvalidEmail","httpStatus":400,"severity":"error","filePath":"packages/backend/server/src/core/auth/magic-link.ts","lineNumber":143,"sourceCode":"      throw new InvalidEmailToken();\n    }\n\n    const user = await this.models.user.fulfill(email);\n\n    return { userId: user.id, method: 'magic_link' };\n  }\n\n  private async assertSignupAllowed(email: string) {\n    if (!this.config.auth.allowSignup) {\n      throw new SignUpForbidden();\n    }\n\n    if (!this.config.auth.requireEmailDomainVerification) {\n      return;\n    }\n\n    if (!(await verifyEmailDomainRecords(email))) {\n      throw new InvalidEmail({ email });\n    }\n  }\n}\n","sourceCodeStart":125,"sourceCodeEnd":147,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/26c515e050211269e911f7d9cfe162a26c83ed98/packages/backend/server/src/core/auth/magic-link.ts#L125-L147","documentation":"In assertSignupAllowed, after allowSignup passes, if config.auth.requireEmailDomainVerification is true the server runs verifyEmailDomainRecords(email) which checks DNS records (MX/TXT) for the email's domain. If verification fails, InvalidEmail is thrown with the email. This is an email-domain allowlisting mechanism: only emails from domains with the expected DNS records can self-register.","triggerScenarios":"config.auth.requireEmailDomainVerification === true AND no existing user AND the email's domain DNS records do not satisfy verifyEmailDomainRecords (missing/incorrect MX or TXT records, DNS lookup failure, transient network error resolving DNS).","commonSituations":"Self-hosted org that restricts signups to corporate domains but the user's email is on a public provider (gmail) or an unverified domain. DNS records were never published. A transient DNS resolution failure on the server caused verification to fail.","solutions":["Use an email address whose domain has the required DNS verification records, or have an admin pre-create the account.","Publish the expected DNS (MX/TXT) records for the target domain and re-try after propagation.","If domain verification is not needed, set config.auth.requireEmailDomainVerification=false.","Check server-side DNS resolution if the domain should be valid but verification fails intermittently."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":"function isInvalidEmail(err: unknown): boolean {\n  return (\n    !!err &&\n    typeof err === 'object' &&\n    (err as { code?: string }).code === 'invalid_email'\n  );\n}","tryCatchPattern":"try {\n  await magicLink.send(email);\n} catch (err) {\n  if (isInvalidEmail(err)) {\n    showUser('This email domain is not allowed. Contact your administrator.');\n    return;\n  }\n  throw err;\n}","preventionTips":["When requireEmailDomainVerification is on, publish the required DNS records for your domain.","Have admins pre-create accounts for users on unverified domains.","Disable requireEmailDomainVerification if domain allowlisting is not needed.","Monitor server DNS resolution health to avoid false negatives."],"tags":["auth","signup","email-verification","dns","config","self-hosted"],"backgroundTag":null,"analyzedSha":"26c515e050211269e911f7d9cfe162a26c83ed98","analyzedAt":"2026-08-12T13:15:16.447Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}