diff --git a/migrations/20190911193842-mailboxes-make-members-fully-qualified.js b/migrations/20190911193842-mailboxes-make-members-fully-qualified.js
new file mode 100644
index 000000000..c9addd67b
--- /dev/null
+++ b/migrations/20190911193842-mailboxes-make-members-fully-qualified.js
@@ -0,0 +1,21 @@
+'use strict';
+
+var async = require('async');
+
+// imports mailbox entries for existing users
+exports.up = function(db, callback) {
+    db.all('SELECT * FROM mailboxes', function (error, mailboxes) {
+        async.eachSeries(mailboxes, function (mailbox, iteratorDone) {
+            if (!mailbox.membersJson) return iteratorDone();
+
+            let members = JSON.parse(mailbox.membersJson);
+            members = members.map((m) => m.indexOf('@') === -1 ? `${m}@${mailbox.domain}` : m); // only because we don't do things in a xction
+
+            db.runSql('UPDATE mailboxes SET memberJson=? WHERE name=? AND domain=?', [ JSON.stringify(members), mailbox.name, mailbox.domain ], iteratorDone);
+        }, callback);
+    });
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
diff --git a/migrations/schema.sql b/migrations/schema.sql
index 134f87ded..90ecd5681 100644
--- a/migrations/schema.sql
+++ b/migrations/schema.sql
@@ -189,7 +189,7 @@ CREATE TABLE IF NOT EXISTS mailboxes(
     type VARCHAR(16) NOT NULL, /* 'mailbox', 'alias', 'list' */
     ownerId VARCHAR(128) NOT NULL, /* user id */
     aliasTarget VARCHAR(128), /* the target name type is an alias */
-    membersJson TEXT, /* members of a group */
+    membersJson TEXT, /* members of a group. fully qualified */
     creationTime TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
     domain VARCHAR(128),
 
diff --git a/src/ldap.js b/src/ldap.js
index f9ff73163..7d8e8f2ca 100644
--- a/src/ldap.js
+++ b/src/ldap.js
@@ -371,7 +371,7 @@ function mailingListSearch(req, res, next) {
     var parts = email.split('@');
     if (parts.length !== 2) return next(new ldap.NoSuchObjectError(req.dn.toString()));
 
-    mailboxdb.getList(parts[0], parts[1], function (error, group) {
+    mailboxdb.getList(parts[0], parts[1], function (error, list) {
         if (error && error.reason === DatabaseError.NOT_FOUND) return next(new ldap.NoSuchObjectError(req.dn.toString()));
         if (error) return next(new ldap.OperationsError(error.toString()));
 
@@ -382,9 +382,9 @@ function mailingListSearch(req, res, next) {
             attributes: {
                 objectclass: ['mailGroup'],
                 objectcategory: 'mailGroup',
-                cn: `${group.name}@${group.domain}`, // fully qualified
-                mail: `${group.name}@${group.domain}`,
-                mgrpRFC822MailMember: group.members.map(function (m) { return `${m}@${group.domain}`; })
+                cn: `${list.name}@${list.domain}`, // fully qualified
+                mail: `${list.name}@${list.domain}`,
+                mgrpRFC822MailMember: list.members // fully qualified
             }
         };
 
diff --git a/src/mail.js b/src/mail.js
index 42b059c0d..60333ddd3 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -76,6 +76,7 @@ var assert = require('assert'),
     sysinfo = require('./sysinfo.js'),
     users = require('./users.js'),
     util = require('util'),
+    validator = require('validator'),
     _ = require('underscore');
 
 const DNS_OPTIONS = { timeout: 5000 };
@@ -1264,10 +1265,7 @@ function updateList(name, domain, members, callback) {
     if (error) return callback(error);
 
     for (var i = 0; i < members.length; i++) {
-        members[i] = members[i].toLowerCase();
-
-        error = validateName(members[i]);
-        if (error) return callback(error);
+        if (!validator.isEmail(members[i])) return new MailError(MailError.BAD_FIELD, 'Invalid email: ' + members[i]);
     }
 
     mailboxdb.updateList(name, domain, members, function (error) {
diff --git a/src/test/ldap-test.js b/src/test/ldap-test.js
index eae345330..52fe65cd4 100644
--- a/src/test/ldap-test.js
+++ b/src/test/ldap-test.js
@@ -785,7 +785,7 @@ describe('Ldap', function () {
 
     describe('search mailing list', function () {
         before(function (done) {
-            mailboxdb.addList('devs', DOMAIN_0.domain, [ USER_0.username.toLowerCase(), USER_1.username.toLowerCase() ], done);
+            mailboxdb.addList('devs', DOMAIN_0.domain, [ USER_0.username.toLowerCase() + '@' + DOMAIN_0.domain , USER_1.username.toLowerCase() + '@external.com' ], done);
         });
 
         it('get specific list', function (done) {
@@ -793,7 +793,7 @@ describe('Ldap', function () {
                 if (error) return done(error);
                 expect(entries.length).to.equal(1);
                 expect(entries[0].cn).to.equal('devs@example.com');
-                expect(entries[0].mgrpRFC822MailMember).to.eql([ USER_0.username.toLowerCase() + '@example.com', USER_1.username.toLowerCase() + '@example.com' ]);
+                expect(entries[0].mgrpRFC822MailMember).to.eql([ USER_0.username.toLowerCase() + '@example.com', USER_1.username.toLowerCase() + '@external.com' ]);
                 done();
             });
         });