alt.hn

8/23/2026 at 7:29:32 PM

Google Workspace thinks my domain is an email provider (2025)

 https://blog.elis.cc/articles/google-workspace-thinks-my-domain-is-an-email-provider/

by el1s7

8/24/2026 at 4:28:22 AM

> 3.) Fictitious Domain Considerations: As you may know, domains that has ".web" have faced issues related to fictitious domain name usage. While ".one" is not ".web" the combination of the subdomain and TLD triggers similar security protocols.

This is an LLM response. It's the classic pattern where the LLM says something completely unrelated to the topic at hand, realizes that it doesn't have a backspace key, and tries to hedge it in.

by CGamesPlay

8/24/2026 at 11:38:57 AM

Has anyone ever tried giving LLMs a backspace? I have long wondered if their responses could be better if they had the ability to correct earlier parts of their text. Imagine how much harder it would be for us to write coherently with no backspace!

by StilesCrisis

8/24/2026 at 12:28:47 PM

Thinking mode is exactly this. The LLM is allowed to dump thoughts, correcting itself along the way, and only surfaces the cleaned-up final answer to the user

by kangalioo

8/24/2026 at 1:03:45 PM

It's not exactly this. It's something like it. But it's not a token that erases a previous token. Not that I know how that would work or how you'd get training data (edit histories of internet comments seem too few).

(You could have a token that hides previous tokens, but that'd be rather closer to CoT.)

by krautsauer

8/24/2026 at 1:10:05 PM

You could burn a few tokens by prompting the LLM to summarize the omit all of the "wrong" answers (where it overrode itself), after the user accepts the response. It'd probably reduce token use in the end, especially for long sessions.

by dpkirchner

8/24/2026 at 2:20:08 PM

I'm not sure how that would work. You'd need to be able to reverse the operations in the KV cache, and I'm not sure if it's doable or not. And then you'd need to pick another path, or "rebalance" the probabilities or you'd go the same token path. CoT is probably easier to implement (but not necessarily better).

by Aissen

8/24/2026 at 3:31:41 PM

You could set up checkpoints where you store off the current state, and roll back to those checkpoints?

by StilesCrisis

8/24/2026 at 3:34:06 PM

Definitely, this is the easy "bruteforce" way, but it would require more memory, and would not resolve the second part of the problem (i.e "how to pick a better path").

by Aissen

8/24/2026 at 5:14:46 PM

I'm not an LLM engineer, but I just got an idea of how it could work, combining CoT + checkpoints :

- use checkpoints to save KV cache before trigger CoT

- trigger CoT, save result as a summary

- go back to previous checkpoint

- instead of generating tokens, add result of CoT summary as input tokens

- continue normally

For the price of twice the KV cache memory, the context stays perpetually small, allowing smarter sessions. You can even apply that continually by summarizing tool calls, etc.

This idea is free.

I'm not sure it's that advantageous though: it consumes more memory, and the sessions are already quite long at 1M+ tokens. One would need to run the economics down, and just test if the shorter sessions are actually smarter with the continuous summarization.

by Aissen

8/24/2026 at 1:09:03 PM

Backtracking, of sorts. The LLM descends a seemingly fruitful path, and all of a sudden that path seems less so. So you backtrack a few tokens ("erasing"/"undoing") and resample the probability distribution a bit back in the stream.

by gspr

8/25/2026 at 2:59:55 AM

Would it retain some memory of the fact that it backtracked? That path becoming less likely somehow?

by krautsauer

8/24/2026 at 1:01:23 PM

ChatGPT does this. It will present an initial response, then change its mind partway through the thinking process and present a different response.

by zarzavat

8/24/2026 at 2:12:59 PM

Oh wow, I'd like to see this. Any prompt which reliably triggers it? (Seahorse emoji comes to mind!)

by StilesCrisis

8/25/2026 at 3:57:41 AM

It does it quite consistently on higher reasoning.

I believe they have made display answer a tool call so that it can keep updating its answer as it thinks, instead of doing all the reasoning up front, essentially inverting the usual flow. You can use this pattern with any model that supports tool calling.

by zarzavat

8/24/2026 at 2:14:31 PM

Copilot does this too, kinda. It will give an initial response, realize that it might tangentially criticize Microsoft, then change that response to a refusal.

by deaton

8/24/2026 at 3:24:59 PM

That's not a backspace, that's just a nanny filter. I think all bigco LLMs have something similar. e.g. Claude obviously uses this to prevent Fable from doing security work.

by StilesCrisis

8/24/2026 at 2:29:18 PM

Chatgpt will erase text it wants to censor if you get near sensitive topics.

by kevin_thibedeau

8/24/2026 at 3:25:32 PM

What sort of prompt would exercise this?

by StilesCrisis

8/24/2026 at 4:21:05 PM

I inquired into a court case against a police officer who committed a sex crime. I only wanted to know the disposition of the case with no details. It briefly spit out a response involving the victim and wiped it away with a refusal to answer more questions. This was a year ago and the behavior may have changed by now.

by kevin_thibedeau

8/24/2026 at 5:35:42 PM

That's just a standard nanny filter. The filter realized it was in the process of saying "sexual assault" or the like, and just shut the conversation down.

by StilesCrisis

8/24/2026 at 11:54:31 AM

Yes, it was invented by an anonymous user on 4chan in the early 2020s, then sanitized by a Google paper some years later as CoT (chain of thought) or thinking tags, where the model iterates on its own before writing a final response.

All models do it now.

by Chu4eeno

8/24/2026 at 4:58:54 AM

There needs to be a Hanlon’s razor but for suspecting something is LLM generated. The typo and grammar mistakes in the response lead me to think it’s a human, but no way to really know.

by natpalmer1776

8/24/2026 at 9:14:53 AM

> The typo and grammar mistakes in the response lead me to think it’s a human

People using LLMs to "spam" slop already caught up on this sentiment and are purposefully introducing grammar and spelling mistakes in the outputs now. I'm not saying yay/nay in this particular case, just sharing what I've seen in the wild. If a company get complaints that customer support is too robotic after starting to use LLMs for it, making it more concise and introducing subtle mistakes are two surefire approaches they'd get recommended.

by embedding-shape

8/24/2026 at 11:08:36 AM

I refuse to believe there are actual human beings so blatantly splitting a single concept into three artificial points.

by neuroticnews25

8/24/2026 at 3:19:36 PM

Been happening for years. You are not talking to a Developer but someone employed to do "support" who 1) might not know much or 2) think they know a lot but they don't 3) can't tell you the actual reason so try and BS an answer that will make you go away.

by lbriner

8/24/2026 at 11:40:42 AM

There needs to be a Grey's law but for suspecting something is LLM generated.

by pwdisswordfishq

8/24/2026 at 5:15:10 AM

I GUARANTEE that was written by AI. This type of slop is unmistakable

by Matheus28

8/24/2026 at 8:22:12 AM

Strongly doubt that a LLM would say "domains that has .web". Maybe it's a human paraphrasing a LLM.

by FeepingCreature

8/24/2026 at 9:16:28 AM

For what it's worth and I know it can't be trusted, one of the AI detectors reported that sentence as "Your most AI sentences"

In this case, the combination of "web" and ".one" triggers these security measures.

It also flagged the whole email as 100% AI.

by cube00

8/24/2026 at 1:17:39 PM

To do this you need to run

    hallucinated command
but wait, this command only existe for aws cli, not for oracle cli, so you need to run

    actual command
Regularly happens to me in chatgpt.

by Traubenfuchs

8/24/2026 at 12:37:29 PM

Plus the idiot bot has confabulated a subdomain.

by chrisjj

8/24/2026 at 3:09:36 PM

Why did you post the exact same comment three hours before this one?

by iamtedd

8/24/2026 at 9:17:15 AM

Plus this idiot bot has confabulated a subdomain.

by chrisjj

8/24/2026 at 6:57:50 AM

This doesn't make sense, even if the LLM had access to the source code

But yeah I kinda understand why would they want to block stuff with 'web'

by raverbashing

8/23/2026 at 11:17:18 PM

My business Workspace account got suspended recently, no reason given, can’t even login to contact support. I’m a solo user so I only had one admin account and that was the one locked out. There was just one text field to submit an appeal, so I did. I never got any email confirmation or tracking number for my appeal, it’s been a week now with no contact from Google. This happened about a week after they charged my credit card for the subscription.

I’m now in the process of switching to Fastmail. Google doesn’t give a shit about anything besides for their golden goose, I would encourage everyone to move away from their services before they just screw you with no warning or recourse just because they can.

by an0malous

8/23/2026 at 11:39:31 PM

I’m also worried that this is just the future of SaaS where everything is a Kafkaesque nightmare of automated processes no one even understands anymore, and even these incidents are lost in so much complexity the businesses either don’t care or don’t even know it’s happening.

by an0malous

8/24/2026 at 4:43:14 AM

It already is, that’s why I prefer companies I can physically visit. My hosting, email, payments for my company are now places I can reach within hours and just have a chat. In person, people are a lot less nasty and they cannot yet (…) fob me off with an AI.

by anonzzzies

8/24/2026 at 2:59:13 PM

To be fair, the last time I had an issue with Google I just drove up to the Googleplex, and the front desk was very helpful routing me to the right real person. Proper support otherwise was impossible.

by hansvm

8/24/2026 at 3:11:18 PM

Little sad it is like that, but at least local vendors have a chance now again. If they don't want to become 'the biggest' / make 'trillions', then you good service and 100k clients works fine too.

by anonzzzies

8/24/2026 at 9:53:00 AM

I think the AI dystopia will save us from the SaaS dystopia and ultimately win.

Dark patterns? AI doesn't care about dark patterns. It will instantly navigate around them.

10% annual price increases for absolutely no reason? No problem! Just build a replacement. 98% of SaaS applications out there no longer have a moat. My friend just contracted out a CRM replacement for Salesforce for a small company for $65k. He built it in a few days for a few hundred dollars. Obviously it's much less feature rich, but this company never used 99% of the features in Salesforce anyway. If anything, a light weight and bespoke CRM was what they always needed and wanted anyway. SaaS just wasn't viable for bespoke.

Ads killing the experience? AI will hunt down every explicit and hidden ad and eradicate it. The entire ad model is about to die.

by Gareth321

8/24/2026 at 1:15:00 AM

That's pretty much the way the work did now if you're dealing with the "right" companies. The future isn't evenly distributed.

by EvanAnderson

8/24/2026 at 11:23:06 AM

Is this particular problem really SaaS behavior, or is it "market share too large to care" behavior?

by bell-cot

8/23/2026 at 11:28:24 PM

I ditched Google Workspace for Proton earlier this year and haven't looked back. Yes, the Proton apps don't integrate with everything and E2E encrypted data isn't as accessible as the data held in Google apps, but that's a bonus at this point.

by pnw

8/24/2026 at 12:37:48 AM

I learned recently that there is controversy around Proton and (surprisingly to me) far-right. Previous HN discussion https://news.ycombinator.com/item?id=48446899

by nha1

8/24/2026 at 12:45:55 AM

Some people understand that there is naunce in the world. This is literally just the view of a single sponsor.

The way everyone gets so up-in-arms about the political views of a person three levels detached from the company is insane.

"Oh no, an individual with different views than me offhandedly mentioned Proton, the horror! I can't possibly differentiate between the views of a company and a separate individual!

Let's go grandstand about canceling our service and discouraging others from signing up because a random person thinks differently than me, and talked about the company."

by copper-float

8/24/2026 at 1:06:25 AM

I believe when the views of that person who has influence on the product, and it does not align with the services they say they desire to provide, it’s an issue.

It also can purely be choosing to not support an organization that doesn’t align with your world view. The money in our pockets is the power to change things.

by evulhotdog

8/24/2026 at 1:21:01 AM

If I’m reading this right, it was a failure at due diligence before sponsoring a YouTube channel. That doesn’t sound at all like what you wrote so maybe you could expand on what the controversy was?

by pitched

8/24/2026 at 9:52:57 AM

Admitted it was a mistake, fixed it. Meanwhile google is actively platforming and funding the far right, and has no issue with it. What is the issue with Proton here exactly? This is a complete nothing burger.

by NietTim

8/24/2026 at 9:54:09 AM

Thankfully you have a domain you can switch. I feel bad for people with Gmail addresses who are really fucked when they're banned.

by Gareth321

8/24/2026 at 5:02:05 AM

I have the same issue but just for Google Cloud thankfully. Never got a response when I filled in the text field. When I contacted support they kept asking me do go to things in the Google Cloud dashboard (that I was banned from). Then eventually the person said they'd escalate and I'd get an email but I never got anything. Maybe I'll try calling a sales number.

by davidd_1004

8/24/2026 at 9:22:46 AM

> Maybe I'll try calling a sales number.

It's your sign to move on, there are hundreds of other cloud providers who will actually provide meaningful human support because they need your business unlike Google.

by cube00

8/24/2026 at 5:16:12 AM

Yea I really resonated with the messaging and mission of Migadu. Super reliable hosting. Have had it for nearly 5 years now. (of course now that I recommend it, I bet they're going to have an outage...)

by dabbz

8/24/2026 at 1:30:22 AM

Dispute the credit card charge and you might be able to get in touch with someone.

by phyzome

8/24/2026 at 8:22:38 AM

Or get your personal Google account permanently banned.

by Kwpolska

8/24/2026 at 9:18:12 AM

Exactly, if you think charging back against Google will result in a human reaching out to actually resolve the problem you are sorely mistaken.

by cube00

8/24/2026 at 12:19:48 AM

I switched over to Zoho, has a lot of the same tools (mail/users/office) but UI is much more tech-y / old-school it e.g. more dense. Gets to the point.

I also use it with my own domain registered outside Zoho, so Zoho cannot actually lock me out of my email ever, only the data they host, though this is true for external domains in Google Workspace also.

by danlugo92

8/24/2026 at 2:46:10 AM

I got into self hosting in 2021.

A cheap 2.5Gb how from racknerd, $20-22/year, + domain.

It's been as smooth sailing as any other email provider.

Very satisfied.

Try it

by 2Gkashmiri

8/24/2026 at 3:03:53 PM

I can give racknerd a +1 by the way (compute rental in my case, not email). Prices are good, machines are machines, support exists and is helpful even for off-the-beaten-path issues, and so far they still exist despite seemingly being a small player. I'd use them again (I don't have many points of comparison though, so take this review with a grain of salt).

by hansvm

8/24/2026 at 6:28:41 AM

How do you back up? What stack are you using?

by Schiendelman

8/24/2026 at 9:26:28 AM

Not OP but I backup with a scheduled rclone to B2 and rsync to my local storage at home so I have the required three copies.

I use the Maildir format so each message is its own file making it atomic.

by cube00

8/24/2026 at 12:14:26 PM

[dead]

by baybal2

8/24/2026 at 9:48:03 AM

I had a similar experience with Google's support this year when I logged to my older Google account from a new device, and I was automatically logged out from everywhere, when I was trying to login again it asked me to provide an OTP, when I asked the form to send me the OTP, it said that I've done so many attempts.

Later, I learnt that this is actually very common problem, if you see the "Me too" count on the Google Community Help, it's about 20K (https://support.google.com/accounts/thread/52598991/my-gmail...) users, that's a huge amount of false positives that Google refuses to care enough about to make a change in their automated account process, which they keep bringing up when users complain, they say the process is automated and nothing could be done about it (well, you are a tech company, can't you like change the code or something?). Unironically I had to wait uncertainly for a week then try, which did not work (same too many attempts), then after two weeks, then after couple of months, until I just gave up and created a new account. After 4 months I was able to finally login again.

by lr0

8/24/2026 at 5:22:39 PM

I'm now at the point where I cannot create a new Google account as my phone number "has been used too many times".

by FireBeyond

8/24/2026 at 11:53:18 AM

Since "me too" begins with "me", support staff couldn't see it, and assumed it was just one product (human) having the issue.

by chadgpt3

8/23/2026 at 10:07:17 PM

I get this sort of thing constantly because my domain, 3e.org, which I have had for 30 years, is apparently impossible. It's either too short to be real, or starts with a number (obviously impossible).

And like the author, 90% of the time I can just disable their front-end validation and go on my merry way.

by dmd

8/24/2026 at 3:27:49 AM

My friend has a short last name, and they still have many websites be like "must be longer then 3 letter"

by jofzar

8/24/2026 at 5:01:46 AM

I was trying to activate Zelle with my bank and since Zelle is used for scams so often I had to do a bunch of identity verification steps while on the phone with my bank.

One of them was to submit a photo of my drivers license. After I did that it OCRed out some details and prepopulated a form with my information. Hitting submit gave me an error saying to use my full middle name, not an initial. My full middle name is a single letter though.

The person on the phone with my bank had no idea what to do and just kept asking me try again.

I busted out my elite hacker skills though and added a space to the end of the middle name field and was able to steal my own identity.

by eco

8/24/2026 at 12:43:12 PM

> My full middle name is a single letter though.

I guess you could follow the Simpsons joke and spell the letter's name. I'm adding this one to my personal list of falsehoods programmers believe about names.

by debugnik

8/24/2026 at 4:06:01 AM

Has your friend tried clearing their cookies?

by dprkh

8/24/2026 at 4:14:20 AM

Super cool website btw.. cheers!

by sebmellen

8/24/2026 at 6:14:54 PM

ahaha I still remember when 3com forced icann to allow leading numbers and that was some shitstorm

by lstodd

8/24/2026 at 7:56:39 PM

Huh? From RFC1123:

<quote>

2.1 Host Names and Numbers

      The syntax of a legal Internet host name was specified in RFC-952 [DNS:4].  One aspect of host name syntax is hereby changed: the restriction on the first character is relaxed to allow either a letter or a digit.  Host software MUST support this more liberal syntax.
</quote>

It's from 1989. ICANN was founded in 1998.

by allarm

8/23/2026 at 10:02:38 PM

Smells like „product engineering“. So a product or an engineering lead gets a task to reduce risks of specific abuse by preventing someone from sending email from yahoo or web.de clone. As a quick solution they add this filter without „overthinking“ it. The impact is low, a few customers in a million, so its stupidity gets unnoticed and, once first complaint reaches them, quietly deprioritized to death. Removing it is cheap: the justification for taking that work is likely the show stopper. Google is an old large corp that hires and fires at a scale. Owning removal of abuse filter to increase revenue by Planck-sized amount is an impossible thing.

by ivan_gammel

8/23/2026 at 10:53:38 PM

> Just for context, this is a premium domain with a very high premium renewal fee, no history of abuse obviously.

The registry premium domains on the new TLDs have several issues. The biggest IMO is a lack of price protection. Non-premium domains at least get the cohort based protection from section 2.10c of the registry agreement.

So, in addition to being treated as a 2nd rate domain, there’s nothing stopping the registry from cranking up the price if a domain gets popular. I don’t think it’s ever happened, but have never found contractual terms that forbid it.

I made a website about it a while ago after a registry reclassified one of my domains from standard to premium.

https://tldrisk.com/beyond-basics/premium-domains/

by TLDRisk

8/24/2026 at 4:38:46 AM

All more reason to stick with standard TLDs like .com, .org, .net, and your country’s TLD when you can.

by dannyw

8/24/2026 at 4:15:59 AM

Do you have a list of TLDs that don’t charge for premium domains? E.g. I have never seen a Registry Premium .com domain.

by sebmellen

8/24/2026 at 11:39:15 AM

Both .com and .net are price controlled. I think for the rest of the gTLDs it would be allowed. There’s a lot of nuance to it. The registry agreement never mentions premium domains, only pricing rules, so being accurate about the rules takes a long explanation. That’s why I made the site I linked.

by TLDRisk

8/24/2026 at 11:58:00 AM

We really need to replace ICANN.

by chadgpt3

8/23/2026 at 9:31:03 PM

The end is really hilarious. Google had a stupid frontend-only validation, it seems.

by sam_lowry_

8/23/2026 at 10:06:17 PM

Since Google themselves claim that's a security check, there's a bug bounty here.

The author of that article missed their chance making Google eat their words.

by chmod775

8/24/2026 at 2:18:10 PM

Or he missed the chance to get Google to move that check to the back end and then when it is time to renew find out that he cannot, if he’s lucky enough for it to not break earlier.

by tzs

8/24/2026 at 12:14:40 AM

I was under the impression Google engineers went through a rigorous hiring process, yet this is the sort of thing you get from lowest bidder consultants who have inexperienced devs.

by pigbearpig

8/24/2026 at 4:08:16 AM

Nah Google and Microsoft have been offshoring to India for years. And sorry, but the developers there suck.

by anon48293

8/24/2026 at 1:21:15 AM

All that leetcode, whiteboarding, and Googly-style interview questions just to put front-end validation for security.

by twostorytower

8/24/2026 at 6:09:27 AM

This seems like something more intended to avoid a bunch of pointless attempted signups from people who don't understand what having a domain means who then won't be able to do the later step where you verify that you actually own it.

A client-side check's not so unreasonable for that kind of thing.

Of course then you still want the list to be accurate and/or actually have some working support flow that results in an overzealous filter getting fixed. The code suggests that they do or did have a process at some point: the list of specific domains is an override that allows domains that would otherwise match one of the regexes and get blocked.

by zerocrates

8/24/2026 at 11:58:38 AM

Yeah but they said it was important security.

by chadgpt3

8/24/2026 at 5:54:34 AM

Google has a computer making decisions that affect humans, and then they then have humans defending the decisions a computer did. We live in a dystopia. I hope "Karen" sees the irony in the day job she is doing.

A COMPUTER CAN NEVER BE HELD ACCOUNTABLE. THEREFORE A COMPUTER MUST NEVER MAKE A MANAGEMENT DECISION.

—IBM, 1979

by anilakar

8/24/2026 at 7:11:32 AM

Technically not allowed in the EU. Will probably take several more years before they get fined a few hundred million again.

by Maxion

8/24/2026 at 7:38:21 AM

Google will present multipe bogus reasons, such as:

1) it is not automated

2) the user consented

3) subjecting oneself to automated processing is a hard requirement

while in reality

1) a human rubberstamping the decision does not make it non-automated

2) coerced or forced consent via ToS and a checkbox is not consent

3) automated processing is not a requirement, just a business decision.

by anilakar

8/23/2026 at 10:12:41 PM

I use a .one for a project where it makes perfect sense. Brevo, who are a huge email delivery platform, told me they don't support signing up with a .one domain. Fortunately, after a couple of weeks going back-and-forth one of their developers eventually saw sense and fixed it.

Sadly, with Google, I don't think you'll ever get the issue that far up the chain.

by qingcharles

8/24/2026 at 3:12:35 AM

I've got a .email domain which various UK based retailers insist isn't a real domain from which email can be sent. I've been trying to convince Argos that it is real for about seven years.

To their credit, my building society actually took it all on board and fixed their system within a few months. To my incredible surprise, so did a major insurer.

by hkt

8/24/2026 at 4:39:27 AM

It probably made its way onto a Jira backlog somewhere, and some engineer thankfully took it as a 1 story point task.

by dannyw

8/24/2026 at 9:23:38 AM

I wonder whether you could use GDPR to force compliance with this. You have the right to correct the record, after all.

by corint

8/24/2026 at 2:51:07 PM

Somehow I suspect GDPR isn't engaged there as they forbid the creation of an account in the first place, so they don't store the data. Maybe I could create an account with a different email address and try it then.

by hkt

8/23/2026 at 10:19:30 PM

Since the author asked about Alice: it was an Internet provider in France in the early 2000's.

Some domains in that list are truly ancient. That was a trip down memory lane.

by dutchCourage

8/24/2026 at 7:14:21 AM

same in italy btw, it was an italian provider with some european presence, since then they rebranded (several times actually)

by kome

8/23/2026 at 9:54:22 PM

Just wait for someone at Google to read this post and then block the domain retrospectively.

by petepete

8/23/2026 at 10:02:40 PM

And ban their entire Google account

by llacb47

8/23/2026 at 10:12:55 PM

And delete all their data.

by qingcharles

8/23/2026 at 10:24:36 PM

*make it hidden, they will of course keep the data for themselves :)

by sunaookami

8/24/2026 at 5:40:15 AM

>write an entire blog post ranting about how the company that runs the product doesn't give a shit and has terrible support

>signs up for it anyway

Why?

by samlinnfer

8/24/2026 at 3:44:12 PM

Notice how they were going to go to Microsoft next?

Clearly a masochist.

by NewJazz

8/24/2026 at 3:38:29 PM

sunk cost fallacy I guess

by el1s7

8/24/2026 at 6:19:27 AM

I'd recommend not coming up with inventive fixes like this. There's a non-zero chance that check is in some server-side validation that you can't work around, and one day something you rely on becomes unrecoverable. Take it as a sign that it won't always work

by f4c39012

8/24/2026 at 2:52:03 PM

Alice once was one of Germany's biggest DSL providers started 1995. Haven't heard of that brand for about a decade. A quick websearch leads to an obviously still existing webmail service.

by otto23

8/23/2026 at 9:46:18 PM

If you could just change your company's domain name that'd be swell!

Surprising Google is happy to lose a paying company over this.

Although the author is taking quite the risk bypassing Google's validation like that. Not sure I'd be risking my company's workspace to do it in case Google wakes up ban hammer happy one morning.

by cube00

8/24/2026 at 2:23:38 AM

Google would rather cheap out on offshore support than waste their engineers' time talking to real customers.

Plus, any entity large enough probably has some kind of account manager or contact in Google that could hopefully escalate to the right person.

by ValentineC

8/24/2026 at 2:28:11 PM

With how many products Google suddenly retires, and how they often just ban or remove accounts without any sort of support, it’s mind boggling to me that anybody still considers to use any Google service honestly.

Well, apart from search and advertisement, maybe.

by anon48293

8/24/2026 at 1:23:22 AM

As usual, this is more than just an honest mistake from Google. Not only is the given justification complete gibberish, it has AI written all over it. They have zero respect for users and it shows.

by soraminazuki

8/24/2026 at 3:44:13 AM

User != customer

by tomasphan

8/24/2026 at 6:19:47 AM

I can only presume this regex is there because Google had to block various scammers trying to use email hosting donain names when novel TLDs came onto the market. You can try to manage gmail.zip or outlook.mov but Google will probably flag you as a scammer if you try to email from them. Just because web.de isn't well-known outside of German circles doesn't mean the risk doesn't exist. These email providers, especially the ones hosted by Microsoft, have a history of buying multiple TLDs to offer users a localised email domain.

Blocking a second level domain like the Ukranians tried to use is surprising, though. I guess it's to prevent domains like outlook.co.uk or something like that?

These regexes were put there for a reason so I doubt they'll get removed, but if they fix their frontend-only detection script you're going to be locked out of your domain some day if you force your way through their checks. Seems awfully risky.

by jeroenhd

8/24/2026 at 6:38:27 AM

Thw regex on the frontend only makes zero sense though.

by chinathrow

8/23/2026 at 10:25:11 PM

I think ditching google would've been a better choice.

by fillthegap

8/23/2026 at 10:38:36 PM

Well, if the alternative was going to be Microsoft 365... not so sure :)

by necovek

8/24/2026 at 1:13:10 AM

Or just ditch both. These companies have nothing but contempt for their users and signing up for their services is just asking for trouble. There are alternatives for email and whatever else is needed from these services.

by soraminazuki

8/24/2026 at 2:05:42 AM

> I was about to ditch Google completely and head over to Microsoft

That is the obvious thing to do. Don't understand why you even waste time there. You are digging a deeper hole for yourself.

If they cannot even provide proper support for sign up, what will happen when your account gets disabled for no obvious reason, and you potentially lose years of emails?

by fg137

8/23/2026 at 11:10:37 PM

the last paragraph was probably most important one here, and the lesson is If you truly want to enforce a validation then it has to be in the backend, the client side validation is just additional luxury if you can afford it.

On a different note, the validations were added for genuine reasons and most likely there would be some discussions/debate on the scope/cost/benefits. I would imagine if some one were to do it a a business seriously then they would have some way to override it on use case basis.

by sandeepkd

8/24/2026 at 7:06:25 AM

In this case I think the validation is the next step when they ask you to set up a DNS record on the domain you typed in, and have their system match it.

Obviously if you typed Outlook.com this would be a challenge for you.

Unfortunately that may mean a support ticket and explanation and whatnot, and wasted time. Charitably, it might even mean the customer experiencing friction and going to another provider.

So in this case, front ending it seems to make a bit of sense, it’s just really clumsily done.

by alibarber

8/23/2026 at 9:36:26 PM

This was a fun read. Absolutely baffling behaviour from Google.

by sikozu

8/24/2026 at 2:08:52 AM

Not baffling at all. Google could not care less about individual users. (lots of horror stories about account getting disabled here and on reddit.) They only care about large enterprise customers. Not even the smaller ones, only the largest. Speaking from first hand experience.

by fg137

8/24/2026 at 6:10:44 AM

A division of the Ukranian government seems to come pretty close to a "large enterprise".

Maybe there are politics involved, but fixing a broken regex seems well worth the time to convince a foreign government to rely on your tech.

Of course, the support request never reached anyone who knows what a regex is, so bugs get confused for policy and nobody cares to fix it.

by jeroenhd

8/24/2026 at 6:29:01 AM

I get it, they want to stop scammeers to sign up with domains that look close like a real email provider. In this case web.de

by Mashimo

8/23/2026 at 9:35:19 PM

alice.it is indeed an email provider's domain; based on the code snippet it seems like they are active in other countries.

alice.app however isn't registered anywhere.

by bonzini

8/23/2026 at 9:35:58 PM

I would hope that somewhere at Google there is a policy that says you can't do anti-fraud and security checks in frontend only...

by t0mas88

8/24/2026 at 3:31:13 PM

But isn't the web so much better now that everything is client side instead of server side?

I still think client side JS apps are the biggest mistake this industry ever made.

by mikey_p

8/23/2026 at 11:11:54 PM

Crazy that .one gets locked, but .arpa is fully okay.

by Elliott-Diy

8/24/2026 at 1:17:17 AM

That's not going to pass the domain ownership validation though.

by soraminazuki

8/24/2026 at 6:37:10 AM

One time in college I bypassed client-side validation to order a burrito in a slightly earlier pickup window. More recently, I unhid html elements for features that were "disabled" on an ISP provided router.

You can query an LLM for "a bookmarklet to show hidden elements and enable disabled inputs".

by pvillano

8/24/2026 at 2:48:45 PM

Asking all those hard dsa questions, only to end up skipping server-side validation in one of their most-used products, is honestly unbelievable.

by Hitish

8/24/2026 at 3:29:43 PM

Stuff like this is why I migrated all my services away from Google. I don't do business with people that treat me like shit.

by mikey_p

8/24/2026 at 2:19:07 AM

Google Workspace has one of the most perplexing interfaces I've ever had the displeasure of getting to know and use.

Namely, it seems impossible to archive users despite the fact that we have a business account and have already archived numerous former employees.

by jd3

8/24/2026 at 8:09:37 AM

"I was curious what would happen if I disabled this function, so I did, and I was happy to find out that once disabled, I was able to continue the sign-up process for my domain successfully. That means that this was only a frontend validation, not a server-side one."

This is so stupid.

by mdrzn

8/24/2026 at 7:25:50 AM

Better then my email invalidate most email checks because it 5 characters wide

by xlmnxp

8/24/2026 at 4:43:35 PM

I love client side validation.

by torh

8/24/2026 at 3:48:29 AM

I was about to say that the response was pretty clear, e.g, “your domain sounds like spam”, and you can’t give a more clear reasoning for “exactly why” than any other spam filter can give you an “exactly why reason”.

But then I saw the work around at it turned out it was just incompetence compounding.

by wodenokoto

8/23/2026 at 10:15:51 PM

ooof that's bad, all levels of support missed the frontend validation and blamed you and an opaque non-existent process instead

by yieldcrv

8/23/2026 at 11:19:08 PM

The engineer that implemented this probably used it to justify promotion.

"Reduced fraudulent signups by <made up metric>. Reduce business risk exposure."

Google engineering has certainly taken a nosedive.

by xyst

8/23/2026 at 11:18:10 PM

that's a trip. nice catch!

by spl757

8/23/2026 at 9:50:03 PM

I wonder how this list ended up being created anyway. Was it a long standing issue, or just some ai slop? web.com, web.org, web.net don't look like an email provider.

by mpalczewski

8/23/2026 at 10:44:09 PM

The rationale probably was that end users primarily identify the email provider by the subdomain, not the TLD, and therefore to prevent spoofing they block all domains where the subdomain corresponds to an email provider, regardless of the TLD. Like, they don’t want to allow gmail.<anything>, and the same for all other email providers they know of.

by layer8

8/23/2026 at 10:01:01 PM

web.net, at least, absolutely is an email provider.

by mh-

8/23/2026 at 10:24:36 PM

web.de is also a big email provider in Germany.

by 0x073

8/23/2026 at 11:14:51 PM

Yes and gmx (listed next to it) as well, and I’m pretty sure that gmx offered/offers multiples TLDs (gmx.net, gmx.de, gmx.at, …)

I think the same goes for Alice (big ISP, offering mail addresses, in multiple countries)

It looks like some of these wildcards are for mail providers who use multiple TLDs.

by brewmarche

8/23/2026 at 10:02:55 PM

fair enough. at least not primarily an email provider. so if they offer any email.

by mpalczewski

8/23/2026 at 11:10:39 PM

scroll through a list of known email providers and you will notice they registered tlds for the countries they operate in, very typical for the old ones like yahoo yandex Freemail Hotmail etcpp

web.de is an oldschool German provider, as is gmx.de (and .at, .fr, .com, ...)

the regex smells like an inexperienced developer trying to be clever

by nom

8/24/2026 at 12:51:09 AM

Or an pretty old regex from before all those new TLDs

by croes

8/24/2026 at 4:01:53 PM

[dead]

by suzuki_yuya

8/24/2026 at 10:28:26 AM

[flagged]

by baptistemicl

8/24/2026 at 5:29:16 AM

If you use a whacky domain name suffix I dunno what else you expect.

Act unconventional and you’ll encounter various inconveniences for doing so, which applies to the real world, too.

by avazhi

8/24/2026 at 9:30:55 AM

Google sells (and also owns) domains with exotic TLDs. It's reasonable to expect them to get handled gracefully.

And as the article explains, it was the prefix (web.*) and not the suffix (one.*) which turned out to be tripping their validation rules.

by sethaurus

8/24/2026 at 11:26:54 AM

That’s right, you should do the conventional thing by using gmail, and then you’ll never encounter any difficulties because Google never make capricious decisions like (checks notes) blocking access from certain paying customers using a half-arsed regex.

by Doctor_Fegg