nats-io/nats-server · error

system account %q can not be in default_js_domain

Error message

system account %q can not be in default_js_domain

What it means

During JetStream option validation (ProcessOptions/JetStream config check), the server rejects a configuration where the system account appears as a key in jsacc_default_domain. The system account cannot be assigned a default JetStream domain because JetStream API domain routing for the system account is fixed. This is a pure startup configuration error: the server refuses to start or enable JetStream until the mapping is removed.

Source

Thrown at server/jetstream.go:2917

				}
				if !found {
					return fmt.Errorf("in non operator mode, `default_js_domain` references non existing account %q", a)
				}
			}
		} else {
			for a := range o.JsAccDefaultDomain {
				if !nkeys.IsValidPublicAccountKey(a) {
					return fmt.Errorf("default_js_domain contains account name %q, which is not a valid public account nkey", a)
				}
			}
		}
		for a, d := range o.JsAccDefaultDomain {
			sacc := DEFAULT_SYSTEM_ACCOUNT
			if o.SystemAccount != _EMPTY_ {
				sacc = o.SystemAccount
			}
			if a == sacc {
				return fmt.Errorf("system account %q can not be in default_js_domain", a)
			}
			if d == _EMPTY_ {
				continue
			}
			if sub := fmt.Sprintf(jsDomainAPI, d); !IsValidSubject(sub) {
				return fmt.Errorf("default_js_domain contains account %q with invalid domain name %q", a, d)
			}
		}
	}
	if o.JetStreamDomain != _EMPTY_ {
		if subj := fmt.Sprintf(jsDomainAPI, o.JetStreamDomain); !IsValidSubject(subj) {
			return fmt.Errorf("invalid domain name: derived %q is not a valid subject", subj)
		}

		if !isValidName(o.JetStreamDomain) {
			return fmt.Errorf("invalid domain name: may not contain ., * or >")
		}
	}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Remove the system account (the value of `system_account`, or "$SYS" if unset) from the `jsacc_default_domain` map in the config file.
2. If you intended to set a domain for application accounts only, keep only non-system account entries in the map.
3. Restart the server; validation runs again at startup.

Example fix

// before
jsacc_default_domain: {
  "$SYS": "domainA"
  "APP": "domainA"
}
// after
jsacc_default_domain: {
  "APP": "domainA"
}

sacc := "$SYS" // or your configured system_account
if _, ok := cfg.JsAccDefaultDomain[sacc]; ok {
    return fmt.Errorf("system account %q must not appear in jsacc_default_domain", sacc)
}

When it happens

Trigger: Setting `jsacc_default_domain` (JsAccDefaultDomain map) with an entry whose key equals the system account (either the built-in default "$SYS" account or the explicitly configured `system_account`).

Common situations: Operators bulk-generating jsacc_default_domain entries for all accounts and accidentally including the system account; configs migrated from single-domain to multi-domain JetStream where the $SYS account was included by a template.

Related errors

• system account not setup
• JetStream cluster requires cluster name
• JetStream cluster requires configured routes or solicited le
• system limit reached
• jetstream already enabled

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/4229325a56ff6eab. Report an issue: GitHub.