{"record":{"id":"d88726b8fbe14272","repo":"RocketChat/Rocket.Chat","slug":"error-email-domain-blacklisted","errorCode":"error-email-domain-blacklisted","errorMessage":"The email domain is blacklisted","messagePattern":"The email domain is blacklisted","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/validateEmailDomain.js","lineNumber":58,"sourceCode":"\t\tthrow new Meteor.Error('error-invalid-email', `Invalid email ${email}`, {\n\t\t\tfunction: 'RocketChat.validateEmailDomain',\n\t\t\temail,\n\t\t});\n\t}\n\n\tconst emailDomain = email.substr(email.lastIndexOf('@') + 1);\n\n\tif (emailDomainWhiteList.length && !emailDomainWhiteList.includes(emailDomain)) {\n\t\tthrow new Meteor.Error('error-invalid-domain', 'The email domain is not in whitelist', {\n\t\t\tfunction: 'RocketChat.validateEmailDomain',\n\t\t});\n\t}\n\tif (\n\t\temailDomainBlackList.length &&\n\t\t(emailDomainBlackList.indexOf(emailDomain) !== -1 ||\n\t\t\t(settings.get('Accounts_UseDefaultBlockedDomainsList') && emailDomainDefaultBlackList.indexOf(emailDomain) !== -1))\n\t) {\n\t\tthrow new Meteor.Error('error-email-domain-blacklisted', 'The email domain is blacklisted', {\n\t\t\tfunction: 'RocketChat.validateEmailDomain',\n\t\t});\n\t}\n\n\tif (settings.get('Accounts_UseDNSDomainCheck')) {\n\t\ttry {\n\t\t\tawait dnsResolveMx(emailDomain);\n\t\t} catch (e) {\n\t\t\tthrow new Meteor.Error('error-invalid-domain', 'Invalid domain', {\n\t\t\t\tfunction: 'RocketChat.validateEmailDomain',\n\t\t\t});\n\t\t}\n\t}\n};\n","sourceCodeStart":40,"sourceCodeEnd":73,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/validateEmailDomain.js#L40-L73","documentation":"Second gate in validateEmailDomain(): the address's domain must not appear in Accounts_Domain_BlackList, and when Accounts_UseDefaultBlockedDomainsList is enabled it must also avoid Rocket.Chat's built-in default blocked-domains list. The whole check only runs when the custom blacklist is non-empty — with an empty Accounts_Domain_BlackList even the default list is skipped. Matching is exact-string on the domain after the last '@'.","triggerScenarios":"Accounts_Domain_BlackList contains 'example.com' and a user is created with that domain; Accounts_UseDefaultBlockedDomainsList=true and the address uses a disposable-mail domain present in the default list; exact-match hits while subdomains are (surprisingly) allowed through.","commonSituations":"Anti-abuse blacklists of disposable domains that later reject legitimate users; stale entries left in the blacklist; admins expecting the default list to apply even with an empty custom blacklist.","solutions":["Remove the domain from Accounts_Domain_BlackList (or fix the stale entry) and retry.","If the rejection came from the built-in list, disable Accounts_UseDefaultBlockedDomainsList (accepting the abuse risk) or use an address on another domain.","Prefer the whitelist flow when strict control is needed instead of piling entries onto the blacklist."],"exampleFix":"// before: Accounts_Domain_BlackList = \"mailinator.com\" -> user@mailinator.com rejected\nawait validateEmailDomain('user@mailinator.com');\n\n// after: drop the entry (empty custom blacklist also skips the default list)\n// Admin > General > Accounts_Domain_BlackList = \"\"\nawait validateEmailDomain('user@mailinator.com');","handlingStrategy":"validation","validationCode":"const isBlacklistedEmailDomain = (email: string, blacklist: string[], useDefaults: boolean): boolean => {\n  const domain = email.slice(email.lastIndexOf('@') + 1).toLowerCase();\n  if (blacklist.length && blacklist.map((d) => d.trim().toLowerCase()).includes(domain)) return true;\n  return useDefaults && DEFAULT_BLOCKED_DOMAINS.has(domain);\n};","typeGuard":null,"tryCatchPattern":"try {\n  await validateEmailDomain(email);\n} catch (err: any) {\n  if (err?.error === 'error-email-domain-blacklisted') {\n    // distinct from the whitelist failure: suggest an alternate address or admin review\n    return reportBlacklistedDomain(email);\n  }\n  throw err;\n}","preventionTips":["Curate Accounts_Domain_BlackList and review it when users report signup failures.","Remember the whole blacklist gate is skipped when the custom blacklist is empty — even the default list.","Matching is exact-string: subdomains are not implicitly blocked."],"tags":["email","domain","blacklist","configuration","user-management"],"backgroundTag":"email-domain-restricted","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}