Sender allowlist

A sender allowlist is a per-webhook list of patterns controlling which senders may trigger email ingest. It is the access control on an otherwise publicly reachable address.

Supported patterns

• Exact address — vendor@stripe.com
• Domain wildcard — *@example.com, or the bare form example.com
• Local-part wildcard — alerts@*

Duplicate patterns are rejected. Listing entries works with any project key; creating or deleting them requires Starter or above.

Open by default

This is the important part. An empty allowlist means open ingest — any sender who knows the address is accepted. That makes the channel usable the moment a webhook is created, but it means the generated address should be treated as a public endpoint. Add allowlist entries before putting the channel in front of anything that matters.

Rejections are silent

Blocked senders are dropped rather than bounced, and disabled projects are dropped too. This is deliberate: bouncing to a forged sender creates backscatter, and bouncing to a real one creates loops. The consequence for operators is that a blocked message produces no bounce notification, so check delivery history rather than waiting for a rejection email.

Related failure modes on the same channel: archived or missing webhooks reject as an unknown recipient, and paused webhooks accept at the SMTP layer then skip without creating a delivery.