I have email-to-case setup in my org, with the emails forwarding to the Email Services Address that Salesforce generates. Our security team noticed that you can send an email directly to the Email Services Address to create the Case and Attachments. Basically this bypasses our mailbox and some of the security we have in place. Is there a way to block emails from people sending directly to the Email Services Address? We basically want the Email Services Address to accept emails forwarded from a specific email.
I did notice the
Accept Email From setting but my understanding is that applies to the sender of the email, not the forwarding email.Obviously, the best option is not to expose that email service address. But if its already out there... you can leverage the email headers to determine if the email was sent directly or via a forwarding rule. If the email was not via a forwarding rule you can either block the creation of the case.
