Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.

Designate untrusted and trusted email domains

Log in to subscribe to topics and get notified when content changes.

Designate untrusted and trusted email domains

Designate specific email domains as untrusted or trusted so that you can monitor the metrics for incoming emails from these sources in your instance.

Before you begin

Role required: security_dashboard_user or admin

About this task

When untrusted or trusted domains send emails to your instance, their daily counts appear on the Untrusted Incoming Email or Trusted Incoming Email metrics on the Email page. You can then track email activity from these domains and use email logs to view specific incoming emails. You can also specify a user, usually a manager, or a security analyst, to notify whenever activity occurs from the untrusted or trusted domain.
Note: Designating an email domain as untrusted is for security tracking purposes only. It does not prevent delivery of emails sent from the domain to your instance. To learn about filtering emails to block their delivery, see Email filters.


  1. Navigate to System Security > Instance Security Center.
  2. On the Instance Security Center homepage, click the Email tile, or click the Email link to access the Email page.
  3. On the Email page, in the Untrusted And Trusted Domain section, click New.
  4. On the form, fill in the fields.
    Table 1. Untrusted And Trusted Domain form
    Field Description
    Domain Name of the email domain that you are designating as untrusted or trusted. For example, enter to designate that trusted emails are sent to the instance from ServiceNow employees.
    Category Category that indicates if the email domain is untrusted or trusted:
    Designates that the email domain as untrusted. You use it to identify domains that send suspicious or emails that pose a potential security threat to the instance.
    Designates that the email domain as trusted. You use it to identify domains when your metrics indicate that the incoming emails from it pose no security threats. Designating the domain as trusted enables you to track its inbound email activity over time.
    Active Check box for enabling or disabling the designated untrusted or trusted status for the specified email domain.
    Notify Name of the user to notify by email when activity occurs in the untrusted or trusted domain. Click the spotlight search icon ( Search) to search for the name of the user. Leave the Notify field blank if you do not want notifications sent.
  5. Click Save.


Untrusted or trusted email domain information is also added to the Untrusted And Trusted Domains listing on the Email page.