nats-io/nats-server · error

in non operator mode, `default_js_domain` references non exi

Error message

in non operator mode, `default_js_domain` references non existing account %q

What it means

When running in non-operator mode, every account named in default_js_domain must be one of the server's configured accounts (or a reserved account). If validation cannot find the account among configured accounts, startup fails with this error because the domain mapping would reference an account the server does not know.

Source

Thrown at server/jetstream.go:2901

	if len(o.JsAccDefaultDomain) > 0 {
		if len(o.TrustedOperators) == 0 {
			for a, domain := range o.JsAccDefaultDomain {
				found := false
				if isReservedAccount(a) {
					found = true
				} else {
					for _, acc := range o.Accounts {
						if a == acc.GetName() {
							if len(acc.jsLimits) > 0 && domain != _EMPTY_ {
								return fmt.Errorf("default_js_domain contains account name %q with enabled JetStream", a)
							}
							found = true
							break
						}
					}
				}
				if !found {
					return fmt.Errorf("in non operator mode, `default_js_domain` references non existing account %q", a)
				}
			}
		} else {
			for a := range o.JsAccDefaultDomain {
				if !nkeys.IsValidPublicAccountKey(a) {
					return fmt.Errorf("default_js_domain contains account name %q, which is not a valid public account nkey", a)
				}
			}
		}
		for a, d := range o.JsAccDefaultDomain {
			sacc := DEFAULT_SYSTEM_ACCOUNT
			if o.SystemAccount != _EMPTY_ {
				sacc = o.SystemAccount
			}
			if a == sacc {
				return fmt.Errorf("system account %q can not be in default_js_domain", a)
			}
			if d == _EMPTY_ {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Add the referenced account to the server's accounts configuration, or fix the name typo.
2. Remove the stale default_js_domain entry for the nonexistent account.
3. If accounts come from an operator mode resolver, run with operator mode so the account resolves via JWT.
4. Validate the config with `nats-server -t` before deploying.

Example fix

// before
accounts: { APP: {} }
default_js_domain: { MISSING_ACC: "domainA" }
// after
accounts: { APP: {}, JSACC: { jetstream: enable } }
default_js_domain: { JSACC: "domainA" }

for name := range cfg.DefaultJSDomain {
    if _, ok := cfg.Accounts[name]; !ok {
        return fmt.Errorf("default_js_domain references unknown account %q", name)
    }
}

When it happens

Trigger: Server config with default_js_domain (JsAccDefaultDomain) containing an account name that is not present in the accounts list and is not a reserved account, in non-operator mode - caught during ProcessOptions at startup.

Common situations: Typo in the account name in default_js_domain; account defined only in another config file or via operator JWT (but server running non-operator); leftover default_js_domain after removing the account from config.

Related errors

• default_js_domain contains account name %q with enabled JetS
• default_js_domain contains account name %q, which is not a v
• default_js_domain contains account %q with invalid domain na
• invalid domain name: derived %q is not a valid subject
• invalid domain name: may not contain ., * or >

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/80c7a5dbd820cab9. Report an issue: GitHub.