Create a key to copy examples filled with your team.
Why did the firewall block a send?
A recipient failed a team firewall check before queue.
The firewall is one policy for the whole team. It is not per tenant. Every catalog check starts off.
REST returns 403 {error: firewall, field: to, message: "blocked by firewall (plus_addressing)", rule: "plus_addressing"}. The rule value changes with the check that hit. Kumo rejects SMTP and HTTP inject with 550 firewall: <rule>.
| rule | When |
|---|---|
temp_providers |
The recipient host is on the disposable-domain list. |
free_providers |
The recipient host is a consumer mailbox such as Gmail. |
plus_addressing |
The recipient local-part contains +. |
denied_domain |
A deny list entry matched. This is not a toggle id. |
Allow wins over catalog checks and deny. An address allow matches the plus-stripped mailbox, so jane+tag@gmail.com matches allow jane@gmail.com. Deny and allow accept a domain or an address. Subdomains match. A TLD such as xyz covers *.xyz. Values are stored lowercase. A leading *. or . is stripped.
Suppressions are unique per team and tenant mailbox. The firewall applies to classes of recipients for the whole team. Enabling free_providers blocks Gmail for every tenant.
To unblock a send, turn the matching check off, add an allow, or remove the deny. A deny entry still blocks when every catalog check is off. Use the dashboard Firewall page or the firewall API.