nats-io/nats-server · error

invalid domain name: may not contain ., * or >

Error message

invalid domain name: may not contain ., * or >

What it means

After the subject-validity check, JetStreamDomain must also pass isValidName, which additionally forbids `.` (dots), `*` and `>` (wildcards). A domain is a single plain token, not a subject; wildcard or dotted values would create ambiguous API subjects and are rejected at startup.

Source

Thrown at server/jetstream.go:2933

			}
			if a == sacc {
				return fmt.Errorf("system account %q can not be in default_js_domain", a)
			}
			if d == _EMPTY_ {
				continue
			}
			if sub := fmt.Sprintf(jsDomainAPI, d); !IsValidSubject(sub) {
				return fmt.Errorf("default_js_domain contains account %q with invalid domain name %q", a, d)
			}
		}
	}
	if o.JetStreamDomain != _EMPTY_ {
		if subj := fmt.Sprintf(jsDomainAPI, o.JetStreamDomain); !IsValidSubject(subj) {
			return fmt.Errorf("invalid domain name: derived %q is not a valid subject", subj)
		}

		if !isValidName(o.JetStreamDomain) {
			return fmt.Errorf("invalid domain name: may not contain ., * or >")
		}
	}
	// If not clustered no checks needed past here.
	if !o.JetStream || o.Cluster.Port == 0 {
		return nil
	}
	if o.ServerName == _EMPTY_ {
		return fmt.Errorf("jetstream cluster requires `server_name` to be set")
	}
	if o.Cluster.Name == _EMPTY_ {
		return fmt.Errorf("jetstream cluster requires `cluster.name` to be set")
	}

	h := strings.ToLower(o.JetStreamExtHint)
	switch h {
	case jsWillExtend, jsNoExtend, _EMPTY_:
		o.JetStreamExtHint = h
	default:

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Remove `.`, `*`, and `>` characters from the `jetstream_domain` value, using a single plain token like `east` or `us-east`.
2. Use hyphens or underscores instead of dots for structure in the domain name.
3. Restart the server after fixing the config.

Example fix

// before
jetstream_domain: "us.*"
// after
jetstream_domain: "us-east"

var validDomain = regexp.MustCompile(`^[^.*>\s]+$`)
if cfg.JetStreamDomain != "" && !validDomain.MatchString(cfg.JetStreamDomain) {
    return fmt.Errorf("jetstream_domain may not contain ., * or >")
}

When it happens

Trigger: Setting `jetstream_domain` (or a default_js_domain entry passing the subject check but failing isValidName) to a value containing `.`, `*`, or `>` — e.g. `"us.*"` or `"east.west"`.

Common situations: Operators confusing domains with subjects and using wildcards; building hierarchical domain names with dots; copying a subject string into a domain field.

Related errors

• default_js_domain contains account name %q with enabled JetS
• in non operator mode, `default_js_domain` references non exi
• default_js_domain contains account %q with invalid domain na
• invalid domain name: derived %q is not a valid subject
• system account not setup

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/ba64e40b024ffe19. Report an issue: GitHub.