cloudflare/cloudflared · error

allowed mail rule %q has an invalid wildcard domain

Error message

allowed mail rule %q has an invalid wildcard domain

What it means

Wildcard entries in the allowed-mail list must be of the form "*@<domain>" where <domain> passes isValidQuickTunnelEmailDomain. If a "*@"-prefixed entry has an invalid domain (empty, malformed, no valid TLD structure), the validator returns "allowed mail rule %q has an invalid wildcard domain" quoting the raw entry. It rejects bad wildcards up front rather than letting them silently match nothing.

Source

Thrown at connection/quick_tunnel_auth_validation.go:25

	"golang.org/x/net/idna"
)

// validateQuickTunnelAllowedMail validates and normalizes exact email addresses and
// wildcard domains from one or more comma-separated values.
func validateQuickTunnelAllowedMail(values []string) (emails, wildcardDomains map[string]struct{}, err error) {
	emails, wildcardDomains = make(map[string]struct{}), make(map[string]struct{})
	for i, rawEntry := range strings.Split(strings.Join(values, ","), ",") {
		entry := normalizeQuickTunnelEmail(rawEntry)
		domain, isWildcard := strings.CutPrefix(entry, "*@")

		switch {
		case entry == "":
			return nil, nil, fmt.Errorf("allowed mail rule %d is empty", i+1)

		case isWildcard:
			if !isValidQuickTunnelEmailDomain(domain) {
				return nil, nil, fmt.Errorf(
					"allowed mail rule %q has an invalid wildcard domain",
					rawEntry,
				)
			}
			wildcardDomains[domain] = struct{}{}

		default:
			if !isValidQuickTunnelEmail(entry) {
				return nil, nil, fmt.Errorf(
					"allowed mail rule %q is not a valid email address",
					rawEntry,
				)
			}
			emails[entry] = struct{}{}
		}
	}

	return emails, wildcardDomains, nil

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Use the full valid domain form: "*@example.com"
2. Remove the wildcard entry if wildcard matching is not intended and list explicit emails instead
3. Check isValidQuickTunnelEmailDomain's rules (no spaces, non-empty, proper domain form) and fix the domain accordingly
4. Escape or quote the value in config files if shell/env processing is stripping characters

Example fix

// before
allowedMail: "*@"
// after
allowedMail: "*@example.com"

func validWildcard(entry string) bool {
	domain, ok := strings.CutPrefix(entry, "*@")
	return ok && domain != "" && !strings.ContainsAny(domain, " ") &&
		strings.Contains(domain, ".")
}

When it happens

Trigger: An entry like "*@", "*@domain with spaces", "*@-bad-.com", or otherwise malformed domain after the "*@" prefix appears in the allowed mail rules.

Common situations: Admins writing "*@company" (missing TLD) or "*@" (missing domain entirely) in quick-tunnel access config; copy-paste errors from documentation examples.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• allowed mail rule %d is empty
• allowed mail rule %q is not a valid email address
• Hostname patterns can have at most one wildcard character ("
• access.TeamName cannot be blank when access.audTags are pres
• Invalid CIDR supplied for %s

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/116083dc8ec6c138. Report an issue: GitHub.