Email address validation rules for format, duplicates, security checks, and domain usage

Address

AtSignMustNotPrecedeEmailAddress

Definition	Severity	API	Sample	Mode
Validate that @ (at-sign character) does not precede an address

Example Validation Report

{
  "code": "VALIDATION__AtSignMustNotPrecedeEmailAddress",
  "severity": "VIOLATION",
  "message": "'@' (at-sign) in 'address' '{{value}} must be removed'",
  "context": {
    "value": "@brand.com"
  },
  "details": {
    "createdDate": "2026-10-10T11:36:02.00Z",
    "submitted": [
      {
        "field": "$.emailIdDetails.address",
        "value": "@brand.com"
      }
    ],
    "compared": [],
    "expected": []
  }
}

EmailAddressInUseUnderDifferentBrand

Definition	Severity	API	Sample	Mode
Validate that an address does not exactly match an existing address under a different brand, same organization.

Example Validation Report

{
  "code": "VALIDATION__EmailAddressInUseUnderDifferentBrand",
  "severity": "VIOLATION",
  "message": "Email address '{{value}}' already in use under different brand ID",
  "context": {
    "value": "other.brand.com"
  },
  "details": {
    "createdDate": "2026-02-10T11:36:02.00Z",
    "submitted": [
      {
        "field": "$.emailIdDetails.address",
        "value": "other.brand.com"
      }
    ],
    "compared": [
      {
        "field": "$.id",
        "value": "9467895078742654921" /* id of brand resource */
      }
    ]
  }
}

EmailAddressInUseUnderSameOrganization

Definition	Severity	API	Sample	Mode
Validate that an address does not exactly match an existing address under the same organization.

EmailAddressIsMatched

Definition	Severity	API	Sample	Mode
Validate that an address does not exactly match an address in an existing resource under the same brand.

Example Validation Report

{
  "code": "VALIDATION__EmailAddressIsMatched",
  "severity": "VIOLATION",
  "message": "Email ID resource with '{{value}}' already exists",
  "context": {
    "value": "duplicate-email@brand.com"
  },
  "details": {
    "createdDate": "2026-02-10T11:36:02.00Z",
    "submitted": [
      {
        "field": "$.emailIdDetails.address",
        "value": "duplicate-email@brand.com"
      }
    ],
    "compared": [
      {
        "field": "$.id",
        "value": "9467895078742654921" /* id of existing matched resource */
      }
    ]
  }
}

EmailAddressMustBePresent

Definition	Severity	API	Sample	Mode
Validate that address is present

Example Validation Report

{
  "code": "VALIDATION__EmailAddressMustBePresent",
  "message": "'address' must be present",
  "severity": "VIOLATION"
}

EmailAddressMustNotBeEmpty

Definition	Severity	API	Sample	Mode
Validate that address is not an empty string

Example Validation Report

{
  "code": "VALIDATION__EmailAddressMustNotBeEmpty",
  "severity": "VIOLATION",
  "message": "'address' must not be empty string"
}

Email ID Details

EmailIdDetailsMustBePresent

Definition	Severity	API	Sample	Mode
Validate that emailIdDetails is present

Example Validation Report

{
  "code": "VALIDATION__EmailIdDetailsMustBePresent",
  "message": "'emailIdDetails' must be present",
  "severity": "VIOLATION"
}

EmailIdMustNotBeUpdated

Definition	Severity	API	Sample	Mode
Validate that resource state is not PUBLISHED

Example Validation Report

{
  "code": "VALIDATION__EmailIdMustNotBeUpdated",
  "severity": "VIOLATION",
  "message": "Email ID cannot be updated"
}

MainDomainPartAlreadyExistsUnderBrand

Preconditions
address has subdomain
Resource state is not DELETED

Definition	Severity	API	Sample	Mode
Validate that the "main" domain part does not match the corresponding part of an existing email ID resource's address, under the same brand

Example Validation Report

{
  "code": "VALIDATION__MainDomainPartAlreadyExistsUnderBrand",
  "severity": "VIOLATION",
  "message": "Main domain part matched in email ID resource `{{id}}`. Email ID resource with subdomain is unnecessary",
  "context": {
    "id": "9467895078742654966"
  },
  "details": {
    "createdDate": "2026-09-01T21:00:59.865Z",
    "submitted": [
      {
        "address": "$.emailIdDetails.address",
        "value": "subdomain.main-domain-part.com"
      }
    ],
    "compared": [
      {
        "field": "$.id",
        "value": "9467895078742654966"
      }
    ],
    "expected": []
  }
}

Security

EmailIdMustPassUrlScan

Definition	Severity	API	Sample	Mode
Validate that address passes security checks

{{reason}}
DMARC record not found or invalid
does not resolve to accepted IP address
does not resolve to accepted IP address version (v4 or v6)
email address is malformed
hostname is neither FQDN, IP v4 nor IP v6. Or, hostname is malicious or a threat

Example Validation Report

{
  "code": "VALIDATION__EmailIdMustPassUrlScan",
  "message": "Email ID did not pass URL scan for reason: '{{reason}}'",
  "severity": "WARNING",
  "context": {
    "reason": "does not resolve to accepted IP address"
  },
  "details": {
    "createdDate": "2026-06-01T21:00:59.865Z",
    "submitted": [
      {
        "field": "$.emailIdDetails.address",
        "value": "example.com"
      }
    ],
    "compared": [],
    "expected": []
  }
}