# "Email in allowed groups" setting is too permissive

**URL:** <https://meta.discourse.org/t/email-in-allowed-groups-setting-is-too-permissive/293307>\
**Category:** Product Support\
**Tags:** email, mailing-list\
**Created:** [January 29, 2024, 3:05pm UTC](https://meta.discourse.org/t/email-in-allowed-groups-setting-is-too-permissive/293307 "2024-01-29T15:05:11Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![joshwhit](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@joshwhit](https://meta.discourse.org/u/joshwhit)\
**Post date:** [January 30, 2024, 11:04am UTC](https://meta.discourse.org/t/email-in-allowed-groups-setting-is-too-permissive/293307/5 "2024-01-30T11:04:44Z")

</div>

Hi,

After some digging and testing I’ve found that if you tick “category mirrors a mailing list” this will skip validation as you can see here in the source code

> <https://github.com/discourse/discourse/blob/main/lib/email/receiver.rb#L1452>

Once I unticked this option then the permissions worked as expected

 ![image](https://global.discourse-cdn.com/meta/original/4X/b/9/b/b9b0b8c81ef4a46c3709507daccd0e727e00a159.png)

This then allowed / disallowed based upon permissions as you would expect

 ![image](https://global.discourse-cdn.com/meta/original/4X/6/3/5/635033327c13f0bf0ce5da5c5a28c7c738912204.png)

Please can this be added to the documentation to help future users?

Thanks very much for your help Lilly.

---

_[View the full topic](https://meta.discourse.org/t/email-in-allowed-groups-setting-is-too-permissive/293307)._