Bug: Case-sensitive email domain validation

[sahillllllllll-bit]

Description

Email domain validation currently treats domains as case-sensitive.

This causes valid email addresses to be rejected when the domain casing differs from the configured allowed or blocked domain lists.

For example, test@GMAIL.com is rejected when gmail.com is present in the allowed domains list.

Since domain names are case-insensitive by standard, this behavior leads to incorrect validation.

Steps to Reproduce

1. Go to Admin Panel → Accounts → Registration

2. Set Allowed Domains List to:
   gmail.com

3. Save the setting

4. Attempt to register with:
   test@GMAIL.com

5. Observe that registration fails ;

6. Try again with:
   test@gmail.com

7. Observe that this succeeds

Expected Behaviour

Email domain validation should be case-insensitive, allowing domains like GMAIL.com when gmail.com is configured.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
gh issue view 40045 --repo RocketChat/Rocket.Chat --json title,body,labels,state,comments,author,createdAt

Length of output: 1634

---

🏁 Script executed:

#!/bin/bash
# Search for domain validation logic related to allowed/blocked domains
rg -n "allowedDomains\|blockedDomains\|allowed_domains\|blocked_domains\|isDomainAllowed\|validateEmail\|emailDomain" --type ts --type js -C 5 | head -150

Length of output: 0

---

🏁 Script executed:

#!/bin/bash
# Try broader search for domain validation
rg -rn "Domain" --type ts -l | head -20

# Search for allowed domain list validation
rg -rn "Accounts_AllowedDomainsList\|allowedDomainList\|domainList" --type ts -C 3 | head -100

Length of output: 1133

---

🏁 Script executed:

#!/bin/bash
# Check the domain validation in email-related files
cat apps/meteor/app/lib/server/lib/defaultBlockedDomainsList.ts

echo "---"
rg -n "domain\|Domain\|allowed\|blocked" apps/meteor/app/lib/server/functions/setEmail.ts -C 3 | head -80

echo "---"
rg -n "domain\|Domain\|allowed\|blocked" apps/meteor/app/lib/server/functions/saveUser/saveNewUser.ts -C 3 | head -80

echo "---"
# Search for the validateEmailDomain or checkEmailDomain function
rg -rn "validateEmail\|checkEmail\|emailDomain\|domainBlocked\|domainAllowed" --type ts -C 5 | head -150

Length of output: 16913

---

🏁 Script executed:

#!/bin/bash
# Check the lib index file
cat apps/meteor/app/lib/server/lib/index.ts

echo "=== setEmail ==="
cat apps/meteor/app/lib/server/functions/setEmail.ts

echo "=== saveNewUser ==="
cat apps/meteor/app/lib/server/functions/saveUser/saveNewUser.ts

Length of output: 6374

---

🏁 Script executed:

#!/bin/bash
# Find and read the validateEmailDomain file
fd "validateEmailDomain" --type f
echo "==="
cat apps/meteor/app/lib/server/lib/validateEmailDomain.ts

Length of output: 143

---

🏁 Script executed:

#!/bin/bash
cat apps/meteor/app/lib/server/lib/validateEmailDomain.js

Length of output: 1969

---

@sahillllllllll-bit Yes, this is a real and confirmed bug! 🐛

Here's the proof from apps/meteor/app/lib/server/lib/validateEmailDomain.js:

const emailDomain = email.substr(email.lastIndexOf('@') + 1);
// emailDomain for "test@GMAIL.com" → "GMAIL.com"

if (emailDomainWhiteList.length && !emailDomainWhiteList.includes(emailDomain)) {
    // "GMAIL.com" is NOT in ["gmail.com"] → throws error ❌

The domain is extracted as-is with no case normalization, and the .includes() / .indexOf() comparisons are strictly case-sensitive. The whitelist/blacklist entries are only .trim()-ed, never lowercased.

Per RFC 5321, domain names in email addresses are case-insensitive, so GMAIL.com, Gmail.com, and gmail.com should all be treated as equivalent.

---

The bug affects two places:

1. ✅ Whitelist (Accounts_AllowedDomainsList) — GMAIL.com not matched against gmail.com
2. ✅ Blacklist (Accounts_BlockedDomainsList + default blacklist) — same case-sensitivity issue

---

Suggested fix (one-liner in validateEmailDomain.js):

- const emailDomain = email.substr(email.lastIndexOf('@') + 1);
+ const emailDomain = email.substr(email.lastIndexOf('@') + 1).toLowerCase();

This normalizes the extracted domain to lowercase before all comparisons, which handles all variants (GMAIL.COM, Gmail.Com, etc.) without needing to change anything else.

Great find! Would you like me to open a pull request plan for this fix?