default_js_domain contains account %q with invalid domain na

Error message

default_js_domain contains account %q with invalid domain name %q

What it means

JetStream domain names are embedded into API subjects via jsDomainAPI, so each domain in jsacc_default_domain must produce a valid NATS subject. The server validates every non-empty domain with IsValidSubject and rejects the config when the derived subject is invalid (e.g. domain contains spaces, illegal characters, or wildcard tokens in bad positions).

Source

Thrown at server/jetstream.go:2923

			for a := range o.JsAccDefaultDomain {
				if !nkeys.IsValidPublicAccountKey(a) {
					return fmt.Errorf("default_js_domain contains account name %q, which is not a valid public account nkey", a)
				}
			}
		}
		for a, d := range o.JsAccDefaultDomain {
			sacc := DEFAULT_SYSTEM_ACCOUNT
			if o.SystemAccount != _EMPTY_ {
				sacc = o.SystemAccount
			}
			if a == sacc {
				return fmt.Errorf("system account %q can not be in default_js_domain", a)
			}
			if d == _EMPTY_ {
				continue
			}
			if sub := fmt.Sprintf(jsDomainAPI, d); !IsValidSubject(sub) {
				return fmt.Errorf("default_js_domain contains account %q with invalid domain name %q", a, d)
			}
		}
	}
	if o.JetStreamDomain != _EMPTY_ {
		if subj := fmt.Sprintf(jsDomainAPI, o.JetStreamDomain); !IsValidSubject(subj) {
			return fmt.Errorf("invalid domain name: derived %q is not a valid subject", subj)
		}

		if !isValidName(o.JetStreamDomain) {
			return fmt.Errorf("invalid domain name: may not contain ., * or >")
		}
	}
	// If not clustered no checks needed past here.
	if !o.JetStream || o.Cluster.Port == 0 {
		return nil
	}
	if o.ServerName == _EMPTY_ {
		return fmt.Errorf("jetstream cluster requires `server_name` to be set")

View on GitHub (pinned to 3a66a489d2)

Solutions

Fix the offending domain value in `jsacc_default_domain` so it forms a valid NATS subject token (alphanumerics, underscores, hyphens, dots, no spaces).
Trim whitespace from the domain value in the config file.
Remove the entry entirely if the domain is not actually needed.

Example fix

// before
jsacc_default_domain: {
  "APP": "my domain"
}
// after
jsacc_default_domain: {
  "APP": "my-domain"
}

Defensive patterns

Strategy: validation

Validate before calling

for acc, domain := range cfg.JsAccDefaultDomain {
    if domain == "" { continue }
    sub := "$JS." + domain + ".API" // mimic jsDomainAPI derivation
    if !nats.IsValidSubject(sub) {
        return fmt.Errorf("account %s domain %q invalid", acc, domain)
    }
}

Prevention

Restrict domain names to [A-Za-z0-9_-] characters.
Trim whitespace from config values at generation time.
Never use * or > in domain names.

When it happens

Trigger: A `jsacc_default_domain` entry with a non-empty domain value that fails IsValidSubject after fmt.Sprintf(jsDomainAPI, d) — e.g. domain containing whitespace, `*`/`>` wildcards used incorrectly, or empty subject tokens.

Common situations: Typo or stray space in a domain name in the config file; copy-pasting a domain containing trailing whitespace; using wildcard characters in a domain name believing they are allowed.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/19f2e362f18a6ef3. Report an issue: GitHub.