{"record":{"id":"ede7e58f9d03c81a","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-domain-ede7e5","errorCode":"error-invalid-domain","errorMessage":"The email domain is not in whitelist","messagePattern":"The email domain is not in whitelist","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/validateEmailDomain.js","lineNumber":49,"sourceCode":"\n\temailDomainWhiteList = value\n\t\t.split(',')\n\t\t.filter(Boolean)\n\t\t.map((domain) => domain.trim());\n});\n\nexport const validateEmailDomain = async function (email) {\n\tif (!validateEmail(email)) {\n\t\tthrow new Meteor.Error('error-invalid-email', `Invalid email ${email}`, {\n\t\t\tfunction: 'RocketChat.validateEmailDomain',\n\t\t\temail,\n\t\t});\n\t}\n\n\tconst emailDomain = email.substr(email.lastIndexOf('@') + 1);\n\n\tif (emailDomainWhiteList.length && !emailDomainWhiteList.includes(emailDomain)) {\n\t\tthrow new Meteor.Error('error-invalid-domain', 'The email domain is not in whitelist', {\n\t\t\tfunction: 'RocketChat.validateEmailDomain',\n\t\t});\n\t}\n\tif (\n\t\temailDomainBlackList.length &&\n\t\t(emailDomainBlackList.indexOf(emailDomain) !== -1 ||\n\t\t\t(settings.get('Accounts_UseDefaultBlockedDomainsList') && emailDomainDefaultBlackList.indexOf(emailDomain) !== -1))\n\t) {\n\t\tthrow new Meteor.Error('error-email-domain-blacklisted', 'The email domain is blacklisted', {\n\t\t\tfunction: 'RocketChat.validateEmailDomain',\n\t\t});\n\t}\n\n\tif (settings.get('Accounts_UseDNSDomainCheck')) {\n\t\ttry {\n\t\t\tawait dnsResolveMx(emailDomain);\n\t\t} catch (e) {\n\t\t\tthrow new Meteor.Error('error-invalid-domain', 'Invalid domain', {","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/validateEmailDomain.js#L31-L67","documentation":"After syntactic validation, validateEmailDomain() compares the address's domain (text after the last '@') against Accounts_Domain_Whitelist; a non-empty whitelist that does not include the domain throws error-invalid-domain. An empty whitelist disables the restriction entirely. The setting is comma-separated and each entry is trimmed when loaded.","triggerScenarios":"Accounts_Domain_Whitelist set to 'corp.com,partner.com' and inviting user@other.com; exact-match failures from case differences ('Corp.com' vs 'corp.com') or stray spaces in the setting; whitelist enabled on a server where admins assumed it was off.","commonSituations":"Onboarding partners/contractors whose domains were never whitelisted; typos or casing issues in the admin setting; confusion between whitelist (allow-mode) and blacklist semantics.","solutions":["Add the exact domain (lowercase, no '@', no spaces) to Accounts_Domain_Whitelist and retry.","If the restriction is unintended, clear Accounts_Domain_Whitelist — empty disables the check.","Re-check case and hidden whitespace in both the setting and the submitted address."],"exampleFix":"// before: Accounts_Domain_Whitelist = \"corp.com\" -> user@partner.com rejected\nawait validateEmailDomain('user@partner.com');\n\n// after: include the partner domain in the setting\n// Admin > General > Accounts_Domain_Whitelist = \"corp.com,partner.com\"\nawait validateEmailDomain('user@partner.com');","handlingStrategy":"validation","validationCode":"const isAllowedEmailDomain = (email: string, whitelist: string[]): boolean => {\n  const domain = email.slice(email.lastIndexOf('@') + 1).toLowerCase();\n  return whitelist.length === 0 || whitelist.map((d) => d.trim().toLowerCase()).includes(domain);\n};","typeGuard":null,"tryCatchPattern":"try {\n  await validateEmailDomain(email);\n} catch (err: any) {\n  if (err?.error === 'error-invalid-domain' && err?.reason?.includes('whitelist')) {\n    // tell the admin which domain must be added to Accounts_Domain_Whitelist\n    return reportDomainNotAllowed(email.slice(email.lastIndexOf('@') + 1));\n  }\n  throw err;\n}","preventionTips":["Keep a canonical lowercase list of allowed domains next to the setting.","Smoke-test the whitelist with one real address after every change.","Remember: empty whitelist means the restriction is OFF; a non-empty list is strict allow-mode."],"tags":["email","domain","whitelist","configuration","user-management"],"backgroundTag":"email-domain-restricted","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}