Google Workspace blocks a legitimate domain because of a regex bug
Google Workspace thinks my domain is an email provider
A developer trying to set up Google Workspace for his company hit a baffling error: "Enter a valid domain name instead of an email provider." After support failed to help, he debugged the sign-up page's JavaScript and found a local validation function that flags domains matching a regex list of email providers. The list includes overly broad patterns like `web\..*` and `me\..*`, which wrongly blocked his `web.` domain and the Ukrainian Ministry of Economy's `me.gov.ua`. Disabling the function in the browser allowed him to proceed, revealing it's only a frontend check.
So apparently, engineers at Google decided that all web.[tld] domains are email providers…
- lr0
I had a similar experience with Google's support this year when I logged to my older Google account from a new device, and I was automatically logged out from everywhere, when I was trying to login again it asked me to provide an OTP, when I asked the form to send me the OTP, it said that I've done so many attempts.
Later, I learnt that this is actually very common problem, if you see the "Me too" count on the Google Community Help, it's about 20K (https://support.google.com/accounts/thread/52598991/my-gmail...) users, that's a huge amount of false positives that Google refuses to care enough about to make a change in their automated account process, which they keep bringing up when users complain, they say the process is automated and nothing could be done about it (well, you are a tech company, can't you like change the code or something?). Unironically I had to wait uncertainly for a week then try, which did not work (same too many attempts), then after two weeks, then after couple of months, until I just gave up and created a new account. After 4 months I was able to finally login again.
- CGamesPlay
> 3.) Fictitious Domain Considerations: As you may know, domains that has ".web" have faced issues related to fictitious domain name usage. While ".one" is not ".web" the combination of the subdomain and TLD triggers similar security protocols.
This is an LLM response. It's the classic pattern where the LLM says something completely unrelated to the topic at hand, realizes that it doesn't have a backspace key, and tries to hedge it in.
- an0malous
My business Workspace account got suspended recently, no reason given, can’t even login to contact support. I’m a solo user so I only had one admin account and that was the one locked out. There was just one text field to submit an appeal, so I did. I never got any email confirmation or tracking number for my appeal, it’s been a week now with no contact from Google. This happened about a week after they charged my credit card for the subscription.
I’m now in the process of switching to Fastmail. Google doesn’t give a shit about anything besides for their golden goose, I would encourage everyone to move away from their services before they just screw you with no warning or recourse just because they can.
- dmd
I get this sort of thing constantly because my domain, 3e.org, which I have had for 30 years, is apparently impossible. It's either too short to be real, or starts with a number (obviously impossible).
And like the author, 90% of the time I can just disable their front-end validation and go on my merry way.
- ivan_gammel
Smells like „product engineering“. So a product or an engineering lead gets a task to reduce risks of specific abuse by preventing someone from sending email from yahoo or web.de clone. As a quick solution they add this filter without „overthinking“ it. The impact is low, a few customers in a million, so its stupidity gets unnoticed and, once first complaint reaches them, quietly deprioritized to death. Removing it is cheap: the justification for taking that work is likely the show stopper. Google is an old large corp that hires and fires at a scale. Owning removal of abuse filter to increase revenue by Planck-sized amount is an impossible thing.
- anilakar
Google has a computer making decisions that affect humans, and then they then have humans defending the decisions a computer did. We live in a dystopia. I hope "Karen" sees the irony in the day job she is doing.
A COMPUTER CAN NEVER BE HELD ACCOUNTABLE. THEREFORE A COMPUTER MUST NEVER MAKE A MANAGEMENT DECISION.
—IBM, 1979
- TLDRisk
> Just for context, this is a premium domain with a very high premium renewal fee, no history of abuse obviously.
The registry premium domains on the new TLDs have several issues. The biggest IMO is a lack of price protection. Non-premium domains at least get the cohort based protection from section 2.10c of the registry agreement.
So, in addition to being treated as a 2nd rate domain, there’s nothing stopping the registry from cranking up the price if a domain gets popular. I don’t think it’s ever happened, but have never found contractual terms that forbid it.
I made a website about it a while ago after a registry reclassified one of my domains from standard to premium.
- sam_lowry_
The end is really hilarious. Google had a stupid frontend-only validation, it seems.