There is a form I built using LWC and apex class. When guest user clicks on the submit button, record is created in a custom object, guest user and team lead receives email about it as well with attachment. However, in the sandbox, in org-wide email addresses, it is allowing to create only one email with default no-reply purpose. I do not want to use the current email for the default no-reply purpose because it is used for different project. I want to use different email id for default no-reply purpose, but as soon as I verify the new email id as default no-reply purpose, the previous email gets disappeared. Is it not possible to have two different email ids for default no-reply purpose in the org-wide addresses? I tried using the new email id and selected the purpose as user-selection, but then when I clicked on the submit button I got this error - File save/link failed: Insert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, You do not have the level of access necessary to perform the operation you requested. But, when I tried with the old email id that has purpose selected as default no-reply address then both guest user and team lead got the email. Team lead email id is in custom label.
Hi @Mohit Edupuganti, You've described a situation common in Salesforce orgs regarding org-wide email addresses and their purposes. Let's clarify your questions and issues:
1. Org-Wide Email Address: Default No-Reply Purpose
Salesforce only allows one org-wide email address to be set as the "Default No-Reply Address" at a time.
- If you try to set a new email address as the default no-reply, it will replace the previous one, which then disappears from the default list.
- You cannot have two different email addresses simultaneously set as default no-reply.
Reference:
Salesforce Documentation: Set Up Org-Wide Email Addresses2. User-Selection Purpose
When you set an org-wide email address as "User Selection", users can choose it when sending emails manually or programmatically, but it is not used for system-generated notifications (like workflow, process builder, or Apex-generated emails unless explicitly specified).
3. Error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY
This error typically means the guest user does not have sufficient permissions to:
- Access the object or record (inserting or attaching files),
- Use the org-wide email address for sending emails,
- Attach files (ContentDocument/ContentVersion/Attachment) to the record.
Possible Causes:
- The org-wide email address is not available to guest users for system emails unless it's set as default no-reply.
- Guest user profile lacks permission to create records/attachments or send emails using that org-wide address.
4. What Can You Do?
A. Org-Wide Email Address Limitations
- Only one default no-reply: If you need a different project to use a separate no-reply address, you must switch the default, but this will impact all system-generated emails using the default.
- For different projects, you can use "User-Selection" purpose, but it may not work for guest users or system emails triggered by Apex unless you specify the org-wide address in your code.
B. For Guest User Emails
- If you want to send emails from a specific org-wide address (not default), you need to:
- Ensure the org-wide address is verified and active.
- In Apex, specify the org-wide address ID in setOrgWideEmailAddressId() on the Messaging.SingleEmailMessage.
- Confirm guest user profile permissions for the custom object, attachments, and email sending.
C. For Attachments
- Guest users have restricted access to upload or attach files, especially with new Salesforce security policies.
- Check that guest user has Read, Create access to the object and related objects (ContentVersion, ContentDocumentLink, etc.).
D. Possible Solutions
- Use the default no-reply for guest user emails (since that's supported).
- For project-specific emails, send emails from Apex using the "User-Selection" org-wide email address, but ensure the sender is not a guest user or elevate permissions.
- Consider using a Flow or a Platform Event to trigger email from a user with more permissions (not guest).
Summary Table
Recommendations
- You cannot have two default no-reply addresses.
- For guest user-triggered emails, you must use the default no-reply org-wide address.
- For project-specific emails, use user-selection but ensure the sender has permissions (not guest).
- Review guest user profile/object permissions and attachment settings.
Regards,
@Raju Petluri
