Note: This functionality is only available for Plus and Premium edition users. See available editions and features here: View Edition Comparison
Administrators can restrict which email domains are allowed when sending reports by configuring an allow list (safe list), a block list, or both. This feature helps ensure reports are only sent to approved recipients and reduces the risk of accidental or unauthorized distribution.
How It Works
When a user adds recipients to a report schedule or sends a report, the system checks each recipient’s email domain against the configured domain rules:
Safe List: Only email domains on the safe list can be added or used.
Block List: Email domains on the block list cannot be added or used.
Both Lists Configured: The safe list is evaluated first, and the block list is used to explicitly deny domains if needed.
If a recipient’s email domain violates these rules, the user will be prevented from adding that recipient, and the report will not be sent to that address.
Configuration Steps
In Salesforce, go to Setup.
Navigate to Custom Settings.
Locate Report Sender Block List and/or Report Sender Safe List.
Click Manage next to the custom setting you want to configure.
Click New to add a custom setting record.
Enter:
Name: Any value (used for identification only).
Domain Value: One email domain per record (for example,
example.com).
Save the record.
Repeat as needed to add additional domains.
Each custom setting record should contain only one domain.
User Experience
When scheduling a report, users will be blocked from adding recipients whose email domains are not permitted. This includes evaluating emails from any selected record, such as Users, Contacts, Leads, or Public Groups.
If the safe list or block list changes after a schedule is created, the rules are re-evaluated when the report runs, and any disallowed recipients will be excluded.
Clear validation messaging is shown to guide users when a recipient cannot be added.
Best Practices
Use the Safe List to strictly limit report delivery to approved domains, such as your company's domain.
Use the Block List to prevent reports from being sent to specific domains (for example, public email providers).
If you already have report schedules, check the recipients before changing the list values to avoid errors.
Test scheduling and sending behavior after changes to confirm the expected outcome.
Notes and Limitations
Domain matching is based on the portion of the email address after
@.Subdomains must be entered explicitly if they should be treated differently.
Changes take effect immediately after saving the custom setting records.