diff --git a/src/externalldap.js b/src/externalldap.js
index 6fa5cd192..9ab3c219f 100644
--- a/src/externalldap.js
+++ b/src/externalldap.js
@@ -178,9 +178,10 @@ function sync(progressCallback, callback) {
                         if (user.dn === externalLdapConfig.bindDn) return iteratorCallback();
 
                         const username = user[externalLdapConfig.usernameField];
+                        const email = user.mail;
 
-                        if (!username) {
-                            debug(`[empty username] username=${username} email=${user.mail} cn=${user.cn} usernameField=${externalLdapConfig.usernameField}`);
+                        if (!username || !email) {
+                            debug(`[empty username or email] username=${username} email=${email} cn=${user.cn} usernameField=${externalLdapConfig.usernameField}`);
                             return iteratorCallback();
                         }
 
@@ -191,27 +192,27 @@ function sync(progressCallback, callback) {
                             }
 
                             if (error) {
-                                debug(`[adding user] username=${username} email=${user.mail} cn=${user.cn}`);
+                                debug(`[adding user] username=${username} email=${email} cn=${user.cn}`);
 
-                                users.create(username, null /* password */, user.mail, user.cn, { source: 'ldap' }, auditsource.EXTERNAL_LDAP_TASK, function (error) {
+                                users.create(username, null /* password */, email, user.cn, { source: 'ldap' }, auditsource.EXTERNAL_LDAP_TASK, function (error) {
                                     if (error) console.error('Failed to create user', user, error);
                                     iteratorCallback();
                                 });
                             } else if (result.source !== 'ldap') {
-                                debug(`[conflicting user] username=${username} email=${user.mail} cn=${user.cn}`);
+                                debug(`[conflicting user] username=${username} email=${email} cn=${user.cn}`);
 
                                 iteratorCallback();
-                            } else if (result.email !== user.mail || result.displayName !== user.cn) {
-                                debug(`[updating user] username=${username} email=${user.mail} cn=${user.cn}`);
+                            } else if (result.email !== email || result.displayName !== user.cn) {
+                                debug(`[updating user] username=${username} email=${email} cn=${user.cn}`);
 
-                                users.update(result.id, { email: user.mail, fallbackEmail: user.mail, displayName: user.cn }, auditsource.EXTERNAL_LDAP_TASK, function (error) {
+                                users.update(result.id, { email: email, fallbackEmail: email, displayName: user.cn }, auditsource.EXTERNAL_LDAP_TASK, function (error) {
                                     if (error) debug('Failed to update user', user, error);
 
                                     iteratorCallback();
                                 });
                             } else {
                                 // user known and up-to-date
-                                debug(`[up-to-date user] username=${username} email=${user.mail} cn=${user.cn}`);
+                                debug(`[up-to-date user] username=${username} email=${email} cn=${user.cn}`);
 
                                 iteratorCallback();
                             }