What causes "allowed mail rule %q is not a valid email address" in cloudflare/cloudflared?

Correct the entry to a complete valid address like "alice@example.com"

allowed mail rule %q is not a valid email address

Error message

allowed mail rule %q is not a valid email address

What it means

Non-wildcard entries in the allowed-mail list must be syntactically valid email addresses per isValidQuickTunnelEmail. Invalid entries (missing @, invalid local part, bad domain) produce "allowed mail rule %q is not a valid email address" quoting the raw entry, preventing unmatchable rules from being accepted into the allowlist.

Source

Thrown at connection/quick_tunnel_auth_validation.go:34

		entry := normalizeQuickTunnelEmail(rawEntry)
		domain, isWildcard := strings.CutPrefix(entry, "*@")

		switch {
		case entry == "":
			return nil, nil, fmt.Errorf("allowed mail rule %d is empty", i+1)

		case isWildcard:
			if !isValidQuickTunnelEmailDomain(domain) {
				return nil, nil, fmt.Errorf(
					"allowed mail rule %q has an invalid wildcard domain",
					rawEntry,
				)
			}
			wildcardDomains[domain] = struct{}{}

		default:
			if !isValidQuickTunnelEmail(entry) {
				return nil, nil, fmt.Errorf(
					"allowed mail rule %q is not a valid email address",
					rawEntry,
				)
			}
			emails[entry] = struct{}{}
		}
	}

	return emails, wildcardDomains, nil
}

func isValidQuickTunnelEmail(email string) bool {
	address, err := mail.ParseAddress(email)
	// ParseAddress accepts mailbox forms such as John Smith <jsmith@example.com>,
	// so require the input to be a bare email address.
	if err != nil || address.Address != email {
		return false
	}

View on GitHub (pinned to 2253eeeb25)

Solutions

Correct the entry to a complete valid address like "alice@example.com"
Verify each comma-separated entry has exactly one '@' with valid local part and domain
If you meant a domain-wide rule, use the wildcard form "*@example.com" instead
Validate the list locally (e.g. with a mail regex) before deploying the config

Example fix

// before
allowedMail: "alice"
// after
allowedMail: "alice@example.com"

Defensive patterns

Strategy: validation

Validate before calling

func validEmailRule(entry string) bool {
	if strings.HasPrefix(entry, "*@") { return true }
	at := strings.Count(entry, "@")
	return at == 1 && strings.Index(entry, "@") > 0 &&
		strings.Index(entry, "@") < len(entry)-1
}

Prevention

Enter complete email addresses, not usernames
Check for double '@' characters in pasted values
Use domain wildcards ("*@domain") for domain-wide allowlists instead of malformed emails

When it happens

Trigger: An allowed mail rule without the "*@" prefix fails isValidQuickTunnelEmail — e.g. "alice", "alice@", "@example.com", or "alice@@example.com".

Common situations: Users entering usernames instead of full email addresses in config; typos like double @; config values where the domain was accidentally stripped.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/74da454047103dab. Report an issue: GitHub.