Approved senders

By default, anyone who knows your Paperwise address can send to it. Turn on Only approved senders and only the addresses and domains on your list get through.

What it is

Under Account → Forward by email → Who can send you’ll find:

Only approved senders: a switch. Off (the default), mail from anyone is accepted. On, only senders on your list are.
Mail from others (shown once the switch is on): what happens to mail from senders not on the list. The row reads Drop (the default) or Keep, marked; tapping it offers Drop it or Keep it, marked as not approved. Kept mail arrives in your Inbox with a Not approved label under its sender.
Your list: each approved address or domain, with a remove button.
Add an approved sender.

An entry can be:

An email address, such as factures@lydec.ma, or
A domain, such as lydec.ma. A domain includes its subdomains, so lydec.ma also covers mail.lydec.ma.

Your list can hold up to 100 entries.

When to use it

Your address started getting spam.
You only ever forward mail yourself, so your own email address is the only sender you need.
You gave your address to a few companies for their bills and want nothing else.

Step by step

Add an approved sender

Go to Account → Forward by email.
Under Who can send, tap Add an approved sender.
Type an email address, or a domain such as lydec.ma, and tap Add.

If you see “That isn’t an email address or a domain.”, check for typos or spaces.

Turn on Only approved senders

Add at least your own email address first, so your forwards still arrive.
Turn on Only approved senders.
Tap Mail from others and choose Drop it or Keep it, marked as not approved. Kept mail counts toward the 200 messages a day.

Remove a sender

Tap the red remove button next to the entry. Mail from that sender is then treated like any other unknown sender.

How Paperwise checks a sender

The “From” line of an email is easy to fake, so a name on your list isn’t enough on its own. A message counts as coming from an approved sender only when it’s verified: when the sender’s email provider can prove the message really comes from the domain in its From line.

In plain words:

Big email providers sign their mail and publish rules (called DMARC, DKIM and SPF) that say which servers may send for their domain.
When the message arrives, our mail provider (Cloudflare) checks those rules and records the result.
If Cloudflare reports any DMARC result, that result alone decides: only a DMARC pass for that exact From domain counts. A fail, or “none” because the domain has no DMARC policy, means unverified, whatever DKIM and SPF say.
Only if there’s no DMARC result at all, a valid DKIM signature or SPF check for exactly the From domain counts.
Anything a sender writes into the message to look verified is ignored, and an unclear or doubled result counts as unverified.

So a message that only claims to be from your bank, but wasn’t sent by your bank’s mail servers, doesn’t match your list, even if your bank’s address is on it.

The list is checked against the message’s From line only. When you forward a message by hand, that’s you. An automatic forward (a rule in your email app) usually keeps the original From line, so the original sender, such as the company, has to be on your list, not your own address.

Mail that fails these checks is marked Unverified sender when you open it in Paperwise, whether or not you limit who can send.

Free and Pro

Approved senders are part of Forward by email, which is Pro.

Privacy

Your approved-senders list is stored readable on our server. Unlike your mail, it isn’t sealed, because our mail server has to read it to check each incoming message. Keep that in mind before you add an address you’d rather keep private.
Changing the list (adding or removing a sender, turning the switch on or off) has to be signed with your account key, so someone who only has your Apple sign-in can’t change it.
Mail that’s dropped is accepted and discarded without a reply, so a sender can’t tell your address from one that doesn’t exist.

Tips

Prefer the full address of a company’s billing sender over its whole domain when you can: it’s narrower.
If a company sends from several addresses, add its domain.
Your own address works well as the only entry if you just forward things yourself, as long as your email provider signs its mail (most large providers do).

What if…

What if mail from an approved sender doesn’t arrive?

The message may have failed the checks above, for example when it was sent through a mailing service on the company’s behalf. Check that the address in its From line (or its domain) is on your list, or turn Mail from others to Keep it, marked as not approved while you work it out. If it reaches you by an automatic forward, add the original sender, not your own address.

What if I add a domain like gmail.com?

Then anyone with an address at that domain gets through. That rarely helps; add the exact addresses instead.

What if I see “Unverified sender” on an item?

The message didn’t pass the sender checks. It may still be genuine (some small senders don’t sign their mail), but be careful with links and attachments in it.