Create a key to copy examples filled with your team.
Email firewall
Block temp mail, free mailboxes, plus-addresses, and listed domains before send.
The firewall is one policy per team. It is not per tenant. Enabling free_providers blocks Gmail for every tenant on the team. The policy applies to REST send, the dashboard test send, SMTP, and HTTP inject. Every catalog check starts off.
Checks
Toggle ids from the catalog. Absence means off. Adding a check later does not turn it on for existing teams.
| id | What it blocks |
|---|---|
temp_providers |
Disposable and throwaway domains. Refreshed daily. |
free_providers |
Consumer mailboxes such as Gmail, Yahoo, Outlook, and iCloud. |
plus_addressing |
Recipients whose local-part contains +. |
REST returns 403 {error: firewall, field: to, message: "blocked by firewall (plus_addressing)", rule: "plus_addressing"}. The rule value changes with the check that hit. SMTP and HTTP inject return 550 firewall: <rule>.
Lists
Deny and allow still apply when every catalog check is off. They accept a domain or a full address. Subdomains match, so mailinator.com also covers foo.mailinator.com. A TLD such as xyz covers *.xyz. Values are stored lowercase. A leading *. or . is stripped.
A deny hit returns the rule denied_domain. That string is not a toggle id.
Allow wins over catalog checks and deny. An address allow matches the plus-stripped mailbox, so jane+tag@gmail.com matches allow jane@gmail.com.
Suppressions stay the mailbox graveyard. Put a person you bounced on suppressions. Put a class of domains on the firewall.
API
GET /api/v1/teams/:team_id/firewallreturnsenabled_checks,available_checks, andentries.PATCH /api/v1/teams/:team_id/firewallreplacesenabled_checks.POST /api/v1/teams/:team_id/firewall_entriesadds a deny or allow value.DELETE /api/v1/firewall_entries/:idremoves one.