--- title: Settings --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Email Security](https://developers.cloudflare.com/api/resources/email_security) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Settings #### SettingsAllow Policies ##### [List email allow policies](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/list) GET/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Get an email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/get) GET/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Create email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/create) POST/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Update an email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Delete an email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Batch allow policy operations](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/batch) POST/accounts/{account\_id}/email-security/settings/allow\_policies/batch ##### ModelsExpand Collapse

AllowPolicyListResponse object {id, created\_at, last\_modified, 12 more } An email allow policy.

id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property

pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.

One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property

Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property

[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_list_response%20%3E%20(schema)>)

AllowPolicyGetResponse object {id, created\_at, last\_modified, 12 more } An email allow policy.

One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property

Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property

[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_get_response%20%3E%20(schema)>)

AllowPolicyCreateResponse object {id, created\_at, last\_modified, 12 more } An email allow policy.

One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property

Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property

[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_create_response%20%3E%20(schema)>)

AllowPolicyEditResponse object {id, created\_at, last\_modified, 12 more } An email allow policy.

One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property

Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property

[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_edit_response%20%3E%20(schema)>)

AllowPolicyDeleteResponse object {id }

id: string Allow policy identifier. formatuuid Link to this property

[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_delete_response%20%3E%20(schema)>)

AllowPolicyBatchResponse object {deletes, patches, posts, puts }

deletes: optional array of object {id }

id: string Allow policy identifier. formatuuid Link to this property