As we recently announced in our 2026 product strategy update, we are focusing on platform stability and security overall, and on May 4th, 2026 we rolled out an important update to begin disabling out-of-domain automation emails. This was part of a larger set of security improvements that we’ve started in order to curb misuse of AppSheet for fraud, spam and phishing.
This change means that automation emails can only be sent to recipients with matching domains that the sender is from.
In order not to destabilize a large number of our existing users, we have only begun rolling out this feature only to new customer accounts and organizations.
We are also providing an exemption policy for any accounts/orgs that may have accidentally been disrupted by this change. Please contact support for more information on how to be exempted.
App creators, the workaround is to engage a third-party email service and have your automations use webhooks to send the email through the service. Not a bad idea anyway if you have service-delivery requirements, need a custom sender address, want to handle unsubscribes and bounces, want logging and metrics, etc.
Thank you for the announcement regarding this matter.
Could you please elaborate on the details?
In short, does this mean that the following will apply to AppSheet accounts created on or after May 4, 2026?
・For Workspaces:
Does this mean that even if the following setting is configured, you will not be able to send emails externally?
In the Admin Console:
Apps > Google Workspace > AppSheet Settings > AppSheet Core License Security Settings, select
“Disable AppSheet Core Security”
In this case, for new accounts that create internal management applications but want to notify their clients, will this no longer be possible?
Is this related to the various negative news reports about phishing?
This is a really sad change
One of the great advantages of using AppSheet was the ease of adjusting the e-mails template… Now the only option will be to program with AppScript
No-Code is losing even more ground.
Due to these changes which are a good security move.
As @Steve mentioned using 3rd party email services is easily achievable, would the team consider help providing users an way to pass attachments as Base64 to the 3rd party email services.
I know this convert to Base64 and send to email service can be done via Appscript, however I was wondering if the team can make this possible in Appsheet without additional appscripts.
A simple function to use in webhooks to send files cleanly and easily.
“For Workspaces… Does this mean that even if the following setting is configured, you will not be able to send emails externally?”
Yes, but to clarify:
All (new and existing) accounts for Workspace organizations created prior to the May 4th rollout will be able to send emails to any domain.
Accounts in Workspace organizations created after May 4th are subject to the restrictions and can only send emails to the org-owned domains.
AppSheet Core Security Toggle
The new May 4th setting overrides the security toggle.
Yes, as mentioned, new accounts created after May 4th are subject to the restriction.
The exception is for Workspace orgs that were created before May 4th. Accounts (from those Workspace orgs) created on or after May 4th will still be able to send out of domain emails.
And for Workspace orgs that were created after May 4th, their accounts will still be able to send automation emails to domains within their Workspace org.
Thank you for your reply.
I understand about Workspace accounts.
However, I would like to ask again about “personal accounts” (e.g., @albarqsalh70).
For personal accounts created on or after May 4, 2026, will I be unable to send emails to anyone other than myself, even if I subscribe to a paid plan and deploy an app?
Yes, this is correct.
Free users can only send emails to themselves.
This also applies to non-Workspace paid plans created on/after May 4th.
App deployment doesn’t affect this.
Also, as a reminder, If you are a Workspace customer and are disrupted by this, you can contact support for a possible exemption.
I am not sure I understand the solution for new users.
A clasic appsheet app pdf generated and sent via email to a “customer”, will now be sent to an internal email… but what service 3rd party can forward that email to an external customer email?
I also think this will reduce the number of new users. Simple bots to send someone a pdf from a doc template and a button will not be so simple anymore.
I didn’t need to save the pdf in google drive, I just put myself in the email CC.
Also I saw today that the option to change the “from” field into something else than “noreply@apsheet.com” is being tested and roled out… seems opposite with this new limitation of external email
