fixes #1323

ra/registration-authority.go

@@ -98,6 +98,7 @@ func NewRegistrationAuthorityImpl(clk clock.Clock, logger *blog.AuditLogger, sta
 const (
 	unparseableEmailDetail = "not a valid e-mail address"
 	emptyDNSResponseDetail = "empty DNS response"
+	multipleAddressDetail  = "multiple e-mail addresses parsed from single contact field"
 )
 
 func validateEmail(ctx context.Context, address string, resolver bdns.DNSResolver) (prob *probs.ProblemDetails) {
@@ -110,6 +111,12 @@ func validateEmail(ctx context.Context, address string, resolver bdns.DNSResolve
 	}
 	splitEmail := strings.SplitN(address, "@", -1)
 	domain := strings.ToLower(splitEmail[len(splitEmail)-1])
+	if len(splitEmail) > 2 {
+		return &probs.ProblemDetails{
+			Type: 	probs.InvalidEmailProblem,
+			Detail: multipleAddressDetail,
+		}
+	}
 	var resultMX []string
 	var resultA []net.IP
 	resultMX, err = resolver.LookupMX(ctx, domain)

ra/registration-authority_test.go

@@ -325,6 +325,7 @@ func TestValidateEmail(t *testing.T) {
 	}{
 		{"an email`", unparseableEmailDetail},
 		{"a@always.invalid", emptyDNSResponseDetail},
+		{"a@email.com b@email.com", multipleAddressDetail},
 		{"a@always.timeout", "DNS problem: query timed out looking up A for always.timeout"},
 		{"a@always.error", "DNS problem: networking error looking up A for always.error"},
 	}