Pro plan

Email domain allowlist

Restrict document access to viewers with email addresses on specific approved domains.

When you enable an email gate on a document, you can restrict access to viewers whose email address belongs to specific domains. This is useful for organizations that want to limit sharing to company email addresses or a set of approved partner domains.

How it works

The domain allowlist appears under Restrict Viewer Email Domains when you enable the email gate for a document. You enter bare hostnames like company.com or partner.org one at a time, pressing Enter after each; they appear as removable chips. An entry must be a plain hostname of at least two dot-separated labels — anything carrying an @, a scheme, a path, or a space is rejected on save rather than silently repaired, because a typo here locks out every viewer. When a viewer submits their email address, the domain of that address is checked against your list. The viewer passes if their domain exactly matches an allowed domain or is a subdomain of one.

For example, if you allow company.com:

The subdomain match is boundary-aware — a domain qualifies only if it equals an allowed entry or ends with a dot followed by it — so notcompany.com cannot pass as company.com on a plain suffix match.

Matching is case-insensitive: entries are lowercased when saved and the submitted address is lowercased when checked. If you leave the domain list empty, the email gate accepts any email address.

Limits

You can specify up to 20 domains. Each domain name can be up to 253 characters (the DNS limit). Setting an allowlist requires Pro; clearing it does not, so an account that drops below Pro can always remove the restriction.

Rejection messages

A rejected address gets an explicit error rather than a silent failure. When your list holds exactly one domain, that message names it (Please use your @company.com email address) — a deliberate trade for usability, and worth knowing if the domain itself is sensitive. With two or more domains the message is generic (Please use an approved email address), so repeated attempts do not enumerate the list.

Threat model

The allowlist checks the domain of a self-asserted email address. Nothing is verified: no confirmation mail is sent, no link is clicked, and no check is made that the mailbox exists or that the viewer can receive mail there. Anyone holding the link who types any syntactically plausible address on an allowed domain passes the gate and reads the document. The address is then recorded as that reader's identity and can be stamped onto watermarked pages, so unverified input also flows into your readership data.

Treat this as a boundary that stops accidental and casual out-of-scope access, not as identity verification or access control. If a document must only reach specific named people, pair the gate with a password, send per-recipient email invites, or both.

With password protection

If a document has both a password gate and a domain allowlist, both must pass, and in that order: the password is verified before a viewer can submit an address at all.

Integration with lead-capture forms

If you use a lead-capture form instead of a plain email gate, the domain allowlist applies to the form's email field. The other fields are checked only for their length cap, never against the allowlist, and a domain rejection is returned as an error on the email field alongside any other field errors.

With email invites

Viewers arriving via an email invite link pre-satisfy the email gate and so bypass the domain allowlist entirely — including invitees whose address is not on it. The invitee's email from the invitation becomes their session identity. Check the allowlist and your invite list agree if the restriction matters.