Hi all, We have a self hosted instance of Discourse in mailing list mode, created to be a replacement for mailman We have 3 categories set up with custom incoming email addresses that create topics, which seemed to be working correctly. Unfortunately we realised that users without “Create” permissions on the category could create topics by sending emails in. I tweaked the “Email notifications in” to restrict to the ability to create topics via email to certain privileged groups. Unfortunately users not in the privileged groups can still create topics via email. I have stopped and started the app and this behavior continued. I have also attempted to update the app to the latest on the tests-passed branch (3.2.0 beta5-dev Commits · discourse/discourse · GitHub) but unfortunately this hasn’t helped. The older build was from around 2 weeks ago “Category mirrors a mailing list” is ticked for all 3 categories. It would be great if we could restrict posting via email to specific groups for each category as this would more closely resemble the permissions for the mailing lists we have migrated from. Replies by email are being denied for users in a way that matches “Reply” in the security settings for the category. It would be great if creating a topic by email was tied to the “Create” settings as well. Any help or guidance would be greatly appreciated, please let me know if you need any information. Many thanks

Have you read this topic yet? [image] Configuring incoming email to create new topics or group messages Site Management bookmark This guide explains how to configure Discourse to create new topics or group messages from incoming emails. It covers site settings, group configuration, and category settings. person_raising_hand Required user level: Administrator Configure incoming email to create new topics or group messages Discourse allows you to send emails to a special address to automatically create new topics in a category or new group messages. This feature is useful for integrating Discourse with ext…

Hi Lillian, Thanks very much for your message, from reading this documentation it sounds like what we are trying to achieve is the expected behavior from Discourse. Reading the linked documentation, this part is most relevant: Why use a category? Using a category is useful if you want to simulate a mailing list. We are using categories for this reason Sending an email to a category will create a topic in said category. This part is working correctly Anyone with access to that category may read and reply using the web interface or via email. This is also working correctly Emails sent to a category must respect the category’s security settings. Users who are unable to reply on the Web UI receive a ReplyNotAllowedError when looking at the email logs which is what we want. Users who are unable to create a topic through the web UI are able to create a topic when emailing the incoming email address which is one of the issues we are having. They are even able to create topics in categories they can’t see Emails sent to a category must respect the email in allowed groups site setting. I started to use this setting in order to prevent unauthorised groups creating topics in the above way but this doesn’t work either. You may disable staged users on a per category basis. Our Discourse instance is invite only so staged users are disabled and any unknown user receives a StrangerNotAllowed error, which is the desired behaviour I’ve tried stopping and starting the app, and upgrading the app through the web GUI. Would you recommend a full rebuild? What logs would be most relevant for these issues? Thanks very much in advance again

Hi again, Just a quick update. I’ve just tried rebuilding the app but the behavior has stayed the same unfortunately. I will try to find some more logs to figure out why this is happening.

Hi, After some digging and testing I’ve found that if you tick “category mirrors a mailing list” this will skip validation as you can see here in the source code lib/email/receiver.rb main raw << "\n\n" raw << "[/details]" end end raw end def notify_about_rejected_attachment(attachments) errors = [] attachments.each do |a| error = a.errors.messages.values[0][0] errors << "#{a.original_filename}: #{error}" end message = Mail::Message.new(@mail) template_args = { former_title: message.subject, destination: message.to, site_name: SiteSetting.title, Once I unticked this option then the permissions worked as expected [image] This then allowed / disallowed based upon permissions as you would expect [image] Please can this be added to the documentation to help future users? Thanks very much for your help Lilly.

"Email in allowed groups" setting is too permissive

Product Support

Lilly (Lillian ) January 29, 2024, 4:21pm 2

Have you read this topic yet?

Topic		Replies	Views
Configuring incoming email to create new topics or group messages Site Management how-to , email-in	3	25505	February 10, 2026
Creating a topic via email without write access to the category? Product Support	3	1809	January 11, 2019
Mirrored mailing list is rejecting registered forum users Bug	2	121	August 1, 2025
Category not accepting "anonymous email" from known users Bug	29	4242	June 12, 2026
How to create topics from a custom email address? Product Support email-in	8	482	August 15, 2024

"Email in allowed groups" setting is too permissive

Related topics