diff --git a/lib/sanitize.js b/lib/sanitize.js
index 00fa582f1710aa3a47939040394c4335345b3b7b..cd63a569f19352ca238ca5e03266db6ad010a8c0 100644
--- a/lib/sanitize.js
+++ b/lib/sanitize.js
@@ -19,19 +19,19 @@ var logger = require('./logging.js').logger;
 module.exports = function (value) {
   var isEmail = function() {
 
-    if (!value.toLowerCase().match(/^[\w.!#$%&'*+\-/=?\^`{|}~]+@[a-z\d-_]+(\.[a-z\d-_]+)+$/i))
+    if (!value.toLowerCase().match(/^[\w.!#$%&'*+\-/=?\^`{|}~]+@[a-z\d_-]+(\.[a-z\d_-]+)+$/i))
       throw "not a valid email";
   };
 
   var isDomain = function() {
-    if (!value.match(/^[a-z\d-_]+(\.[a-z\d-]+)+$/i)) {
+    if (!value.match(/^[a-z\d_-]+(\.[a-z\d-]+)+$/i)) {
       throw "not a valid domain";
     }
   };
 
   var isOrigin = function() {
     // allow single hostnames, e.g. localhost
-    if (!value.match(/^https?:\/\/[a-z\d-_]+(\.[a-z\d-_]+)*(:\d+)?$/i)) {
+    if (!value.match(/^https?:\/\/[a-z\d_-]+(\.[a-z\d_-]+)*(:\d+)?$/i)) {
       throw "not a valid origin";
     }
   };