Your email address decides who checks your password

Most sign-in pages ask for an address and a password on the same screen. Rutba asks for the address first, and then decides something before anybody types a password: who is entitled to check it.

For most people the answer is Rutba’s own sign-in. For a company running its own Rutba — its own instance, its own staff records, its own password rules — the answer is their installation, and the centre hands the person over to it rather than holding a second copy of their credentials.

The domain names the realm

The lookup uses the domain of the address and nothing else. A verified company domain that is not a public email provider names an organization; that organization’s own installation is where its people sign in, and it carries the issuer and keys that prove the answer it gives back.

Both halves have to hold. A domain that maps to an organization with no live installation answers as nobody’s — naming the organization would tell a stranger the domain is ours while sending them nowhere useful. A suspended installation is the same answer, because there is nowhere for anybody to sign in whatever the domain says.

The same answer for an address that does not exist

This lookup runs in front of somebody who has not signed in, which makes it the most exposed thing in the whole journey. If it could tell a real address from an invented one, it would be a free service for checking whether a person works somewhere — run down a list of names at a company, keep the ones that answer differently, and you have a phishing target list.

So nothing on this path takes a person, a membership, or the local part of an address. It takes the domain. Two addresses at one domain cannot produce different answers, however hard a caller pushes, because the difference between them is never read. That is a property of the shape rather than a promise about behaviour, which is the only kind worth publishing.

A real address and an invented one at the same domain must answer identically — and they do, because nothing on the path ever looks at the address.

A directory outage is not a sign-in outage

If the lookup cannot be made at all, sign-in carries on with the answer nearly everybody gets anyway: Rutba’s own. Nobody is stopped at the door because a list was briefly unavailable.

That rule has a sharp edge, and we found it the hard way. The service that answered the lookup had been retired, and the address configured for it went on pointing at a port nothing was listening to. Every lookup failed; every failure fell back to “sign in here”; and because that is the right answer for most people, nothing looked broken. A path that had been built on both ends, configured, and tested in isolation was doing nothing at all for weeks.

The fix was to serve the lookup from the records that already describe which organization owns which domain, in the backend that now holds them — no new fields, no second copy, and one fewer service in the path. The gate it had to pass was the one the retired service set for itself: a real address and an invented one at the same domain, answering identically.