knadh/listmonk · warning

subscribers.domainBlocklisted

Error message

subscribers.domainBlocklisted

What it means

SanitizeEmail enforces domain allowlist/blocklist rules configured in settings after validating the address syntax. If an allowlist exists and the email's domain is not in it, the import row is rejected with the localized message 'subscribers.domainBlocklisted'. Blocklist checking is moot when an allowlist is present since the allowlist is authoritative.

Source

Thrown at internal/subimporter/importer.go:630

	addr, err := utils.SanitizeEmail(email)
	if err != nil {
		return "", errors.New(im.i18n.T("subscribers.invalidEmail"))
	}

	// Check if the e-mail's domain is blocklisted. The e-mail domain and blocklist config
	// are always lowercase.
	if im.hasAllowlist || im.hasBlocklist {
		d := strings.Split(addr, "@")
		if len(d) != 2 {
			return addr, nil
		}

		domain := d[1]

		// If there's an allowlist, check if the domain is in it. Checking blocklist after that is moot.
		if im.hasAllowlist {
			if !im.checkInList(domain, im.hasAllowlistWildcards, im.domainAllowlist) {
				return "", errors.New(im.i18n.T("subscribers.domainBlocklisted"))
			}
		} else if im.hasBlocklist {
			if im.checkInList(domain, im.hasBlocklistWildcards, im.domainBlocklist) {
				return "", errors.New(im.i18n.T("subscribers.domainBlocklisted"))
			}
		}
	}

	return addr, nil
}

// ValidateFields validates incoming subscriber field values and returns sanitized fields.
func (im *Importer) ValidateFields(s SubReq) (SubReq, error) {
	if len(s.Email) > 1000 {
		return s, errors.New(im.i18n.T("subscribers.invalidEmail"))
	}

	em, err := im.SanitizeEmail(s.Email)

View on GitHub (pinned to 670c01717d)

Solutions

  1. Add the missing domains to the allowlist in Settings → Privacy, or use wildcard entries like *.company.com for subdomains.
  2. Remove/disable the domain allowlist if you intend to import unrestricted external addresses.
  3. Split the import: keep only allowlisted-domain rows and handle the rest separately.
  4. Use wildcards in the allowlist when subdomains should be accepted.

Example fix

// before (settings)
domain_allowlist = ["company.com"]
// after
domain_allowlist = ["company.com", "*.company.com", "gmail.com"]
Defensive patterns

Strategy: validation

Validate before calling

domain := strings.ToLower(email[strings.Index(email, "@")+1:])
allowed := map[string]bool{"company.com": true, "*.company.com": true}
allowedHere := false
for a := range allowed {
    if ok, _ := path.Match(a, domain); ok { allowedHere = true; break }
}
if !allowedHere {
    return fmt.Errorf("domain %s not in allowlist; row will be rejected", domain)
}

Try / catch

em, err := importer.SanitizeEmail(email)
if err != nil && err.Error() == im.i18n.T("subscribers.domainBlocklisted") {
    log.Printf("domain not allowed: %s", domain)
    continue
}

Prevention

When it happens

Trigger: ValidateFields imports a subscriber whose email domain (text after '@') fails im.checkInList against im.domainAllowlist because im.hasAllowlist is true and the domain (including wildcard patterns) does not match.

Common situations: Admin enables a domain allowlist (e.g. only company.com) then imports a list containing gmail.com addresses; subdomains like mail.company.com when only company.com without wildcards is allowlisted; punycode/IDN mismatches.

Related errors

AI-assisted analysis of knadh/listmonk@670c01717d (2026-09-01). Data as JSON: /api/errors/9b3feff0ab81fca7. Report an issue: GitHub.