cloudflare/cloudflared · error

allowed mail rule %d is empty

Error message

allowed mail rule %d is empty

What it means

validateQuickTunnelAllowedMail parses the allowed-mail configuration into individual rules (splitting on commas after joining values). An empty entry between or around commas yields "allowed mail rule %d is empty". The validator fails fast so an empty allowlist rule doesn't accidentally broaden or corrupt quick-tunnel email access validation.

Source

Thrown at connection/quick_tunnel_auth_validation.go:21

import (
	"fmt"
	"net/mail"
	"strings"

	"golang.org/x/net/idna"
)

// validateQuickTunnelAllowedMail validates and normalizes exact email addresses and
// wildcard domains from one or more comma-separated values.
func validateQuickTunnelAllowedMail(values []string) (emails, wildcardDomains map[string]struct{}, err error) {
	emails, wildcardDomains = make(map[string]struct{}), make(map[string]struct{})
	for i, rawEntry := range strings.Split(strings.Join(values, ","), ",") {
		entry := normalizeQuickTunnelEmail(rawEntry)
		domain, isWildcard := strings.CutPrefix(entry, "*@")

		switch {
		case entry == "":
			return nil, nil, fmt.Errorf("allowed mail rule %d is empty", i+1)

		case isWildcard:
			if !isValidQuickTunnelEmailDomain(domain) {
				return nil, nil, fmt.Errorf(
					"allowed mail rule %q has an invalid wildcard domain",
					rawEntry,
				)
			}
			wildcardDomains[domain] = struct{}{}

		default:
			if !isValidQuickTunnelEmail(entry) {
				return nil, nil, fmt.Errorf(
					"allowed mail rule %q is not a valid email address",
					rawEntry,
				)
			}
			emails[entry] = struct{}{}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Remove empty entries and stray commas from the allowed mail list
2. Trim whitespace in the config so entries don't normalize to empty
3. Validate the config value with a quick split-and-check before applying it
4. If generated programmatically, filter out empty strings before joining with commas

Example fix

// before
allowedMail: "alice@example.com,,bob@example.com"
// after
allowedMail: "alice@example.com,bob@example.com"

entries := strings.Split(config.AllowedMail, ",")
for i, e := range entries {
	if strings.TrimSpace(e) == "" {
		return fmt.Errorf("allowed mail rule %d is empty", i+1)
	}
}

When it happens

Trigger: The allowed mail configuration contains consecutive commas (e.g. "a@x.com,,b@x.com"), a leading/trailing comma (",a@x.com"), or whitespace-only entries that normalize to empty strings.

Common situations: Hand-edited config files with stray commas; env-var list values with trailing commas; merge artifacts in YAML/JSON config where an array element became empty.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• allowed mail rule %q has an invalid wildcard domain
• allowed mail rule %q is not a valid email address
• access.TeamName cannot be blank when access.audTags are pres
• Invalid CIDR supplied for %s
• unable to generate a connector UUID: %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c51a925402ba8a09. Report an issue: GitHub.