Image forming device

Abstract

To provide an image forming device capable of combining convenience of a scan mail function with improvement of security.SOLUTION: A control program 34 permits mail transmission of scan data when a domain included in a transmission mail address and a permitted domain match, but prohibits the mail transmission when they do not match. When an acquired domain and the permitted domain do not match (S147: NO), the control program 34 stores the acquired domain as a registration candidate domain 116a in a memory 14 (S157) and transmits a mail prohibition report mail 125 indicating occurrence of the registration candidate domain 116a toward a manager of a MFP 10 (S165). Then, it is possible to register the registration candidate domain 116a which is stored in the memory 14, in a permitted domain list 43.SELECTED DRAWING: Figure 9

Description

[Technical field]

[0001] The present invention relates to an image forming apparatus having a function of sending scan data formed by a scanner by email. [Background technology]

[0002] The following Patent Document describes an image forming apparatus having a function of sending scan data formed by a scanner by email. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2007-214962 A Summary of the Invention [Problem to be solved by the invention]

[0004] In an image forming apparatus equipped with a scan mail function, such as the image forming apparatus described in Patent Document 1, it is necessary to restrict the destination of mail from a security standpoint, but excessive restrictions may lead to a decrease in usability. Therefore, an object of the present invention is to provide an image forming apparatus that achieves both ease of use of the scan mail function and improved security. [Means for solving the problem]

[0005] In order to solve the above problem, an image forming apparatus disclosed in an embodiment is an image forming apparatus including a user interface, a communication interface, a controller, and a scanner, wherein the controller is configured to, when sending scan data formed by the scanner by email, send the scan data via the communication interface if an acquired domain matches an allowed domain, and to restrict the email sending of the scan data if the acquired domain does not match the allowed domain, wherein the acquired domain is a domain included in a destination email address of the email sending, and the allowed domain is a domain included in an allowed domain list that is pre-registered in the image forming apparatus, wherein the controller is configured to, when the acquired domain does not match the allowed domain, store the acquired domain in a memory as a registration candidate domain and send a message indicating that the registration candidate domain has been generated to an administrator of the image forming apparatus, wherein the registration candidate domain is a domain that is a candidate for registration as the allowed domain in the allowed domain list, and the controller is configured to be able to register the registration candidate domain stored in the memory in the allowed domain list.

[0006] In addition, in order to solve the above problem, the image forming apparatus disclosed in the embodiment is an image forming apparatus including a user interface, a communication interface, a controller, and a scanner, the image forming apparatus is capable of setting an allowed address list, which is a list of email addresses to which scan data formed by the scanner is permitted to be sent by email, the controller is configured to send the scan data via the communication interface when a destination email address for the email transmission is an email address included in the allowed address list, and to restrict the email sending of the scan data when the destination email address is an email address not included in the allowed address list, the controller is configured to store the destination email address in a memory as a registration candidate email address when the destination email address is an email address not included in the allowed address list, and to send a message indicating that the registration candidate email address has been generated to an administrator of the image forming apparatus, the registration candidate email address being an email address that is a candidate for registration in the allowed address list, and the controller is configured to be able to register the registration candidate email address stored in the memory in the permitted address list. Effect of the Invention

[0007] The image forming apparatus disclosed in the embodiment can achieve both ease of use of the scan mail function and improved security. [Brief description of the drawings]

[0008] [Figure 1] 1 is a block diagram of a communication system according to a first embodiment. [Diagram 2] FIG. 4 is a flowchart of the control program 34. [Diagram 3] FIG. 7 is a diagram showing a permission list setting screen 70. [Figure 4] FIG. 13 is a diagram showing setting information including an allowed domain list. [Diagram 5]FIG. 1 shows a home screen 100. [Figure 6] FIG. 4 is a flowchart of the control program 34. [Figure 7] FIG. 7 is a diagram showing a screen transition accompanying the processing of FIG. 6. [Figure 8] FIG. 4 is a flowchart of the control program 34. [Figure 9] FIG. 4 is a flowchart of the control program 34. [Figure 10] FIG. 4 is a flowchart of the control program 34. [Figure 11] FIG. 4 is a flowchart of the control program 34. [Figure 12] FIG. 13 is a diagram showing screen transitions in the EWS and user I / F 15. [Figure 13] FIG. 13 is a diagram showing a failed transmission list screen. [Figure 14] FIG. 4 is a flowchart of the control program 34. [Figure 15] FIG. 4 is a flowchart of the control program 34. [Figure 16] FIG. 11 is a diagram showing a permission list setting screen 170 according to the second embodiment. [Figure 17] FIG. 11 is a flowchart of a control program 34 according to the second embodiment. [Figure 18] FIG. 11 is a flowchart of a control program 34 according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] (First embodiment) A first embodiment of the present invention will be described below with reference to the accompanying drawings. Fig. 1 is a block diagram of a communication system according to the first embodiment. The communication system shown in Fig. 1 includes an MFP (an example of an image forming apparatus) 10, a server 50, and a PC 60.

[0010] The MFP 10 mainly comprises a CPU (an example of a controller) 12, a memory 14, a user I / F 15 (an example of an operation panel), a scanner 20, a printer 22, a modem 24, and a network I / F 28 (an example of a communication interface). I / F is an abbreviation of interface. These components are capable of communicating with each other via a bus 32.

[0011] The CPU 12 executes processing in accordance with a control program 34 in the memory 14. The CPU 12 also functions as a web server by executing processing in accordance with an EWS (embedded web server) program 35. The web server realized by the CPU 12 operating in accordance with the EWS program 35 is also referred to as an EWS. The EWS is an example of a remote user interface of the present application. The memory 14 (an example of a memory) also includes a data storage area 36. The data storage area 36 is an area for storing data necessary for executing the control program 34 and the like. The memory 14 is configured by combining a RAM, a flash memory, a buffer provided in the CPU 12, and the like. The memory 14 may further be combined with a HDD, a portable storage medium such as a USB memory that is detachably attached to the MFP 10, and the like. The memory 14 may be a single unit such as a RAM.

[0012] Furthermore, the memory 14 may be an example of a computer-readable storage medium. A computer-readable storage medium is a non-transitory medium. In addition to the above examples, non-transitory media also include recording media such as CD-ROMs and DVD-ROMs. A non-transitory medium is also a tangible medium. On the other hand, an electrical signal carrying a program downloaded from a server on the Internet is a computer-readable signal medium, which is a type of computer-readable medium, but is not included in non-transitory computer-readable storage media.

[0013] Moreover, the user I / F 15 has a display 16 and an input I / F 18. The display 16 is a liquid crystal display that displays various information of the MFP 10. The display 16 is not limited to a liquid crystal display, and may be a display of another display type such as an organic electroluminescence (EL) display. The input I / F 18 (an example of an operation panel) is, for example, a touch panel that is configured integrally with the display 16, and accepts user operations on icons, buttons, and the like displayed on the display 16. The input I / F 18 may also be a hard key or the like other than a touch panel. The MFP 10 may also be provided with a display alone or an input I / F alone as a user interface.

[0014] The scanner 20 has a reading sensor such as a CCD or CIS, and generates image data corresponding to the reading of an original as scan data. The printer 22 executes a printing operation to print an image on a recording medium such as a sheet or a disk. The sheet is paper or an OHP. The recording method of the printer 22 may be an inkjet method, an electrophotographic method, or the like.

[0015] The modem 24 modulates the original data to be transmitted using the facsimile function into a transmittable signal and transmits it via the telephone line network 38, or receives a signal input from the telephone line network 38 and demodulates the original data.

[0016] The network I / F 28 is an I / F for performing communication using a network protocol such as TCP / IP, thereby enabling the MFP 10 to communicate with external devices such as a server 50 and a PC 60.

[0017] In this specification, the processing of the CPU 12 according to the instructions written in the program is basically indicated. That is, in the following description, the processing such as "judging", "selecting", "deciding", "identifying", "obtaining", "accepting", and "controlling" represent the processing of the CPU 12. The processing by the CPU includes hardware control using the API of the OS. In this specification, the description of the OS is omitted and the operation of each program is explained. That is, in the following description, a description to the effect that "program B controls hardware C" may also mean that "program B controls hardware C using the API of the OS". In addition, the processing of the CPU 12 according to the instructions written in the program may be described in abbreviated terms. For example, it may be described as "performed by the CPU 12". In addition, the processing of the CPU 12 according to the instructions written in the program may be described in abbreviated terms such as "performed by program A".

[0018] In addition, in this specification, "obtain" is used as a concept that does not necessarily require a request. In other words, the process of the CPU 12 receiving data without making a request is also included in the concept of "the CPU obtains data." In addition, in this specification, "data" is represented as a bit string that can be read by a computer. Data with the same substantial meaning but different formats are treated as the same data. The same applies to "information" in this specification. In addition, "request" and "instruct" are concepts that indicate outputting information indicating a request or information indicating an instruction to the other party. In addition, information indicating a request or information indicating an instruction is also simply referred to as "request" and "instruction."

[0019] Furthermore, the process by the CPU 12 to determine whether information A indicates event B may be conceptually described as "determining whether event B is present from information A." The process by the CPU 12 to determine whether information A indicates event B or event C may be conceptually described as "determining whether event B or event C is present from information A."

[0020] The MFP 10 can execute IFAX processing and ScanToEmail processing. The IFAX processing and ScanToEmail processing are processing for creating scan data by reading an image with the scanner 20, and sending the created scan data to an arbitrary email address (hereinafter, sometimes simply referred to as "email transmission"). The IFAX processing is processing for sending the created scan data by email in a manner conforming to an international standard. The ScanToEmail processing is processing for sending the scan data by email in accordance with a standard defined by the manufacturer of the MFP 10, for example, without being bound by the IFAX standard. The MFP 10 of the first embodiment has an allowed domain list set, and in the IFAX processing and ScanToEmail processing, email transmission to email addresses other than email addresses including domains (hereinafter, sometimes referred to as allowed domains) registered in the allowed domain list and email addresses including subdomains is restricted. The domain is the character string following the at sign (@) of an email address. For convenience, an email address including a domain and an email address including a subdomain are also referred to as a "domain email address" and a "subdomain email address".

[0021] First, the setting of various parameters related to e-mail transmission, such as the permitted domain list, will be described. Incidentally, storing parameters in the memory 14 may also be referred to as setting. Incidentally, storing parameters in the memory 14 may also be referred to as registration. The registration of the permitted domain list in the MFP 10 may be executed, for example, in a web page provided by the EWS. The process of the control program 34 executed in the MFP 10 that receives a display request for a web page transmitted from the PC 60 will be described below with reference to the flowchart shown in FIG. 2. Incidentally, the PC 60 transmits the display request using a browser. Also, the MFP 10 may accept operations such as registration of the permitted domain list, which are possible by the EWS described below, via the touch panel of the input I / F 18, when the administrator is logged in to the MFP 10.

[0022] First, when a request to display a web page is made, the CPU 12 functioning as the EWS transmits web page data (an example of image data) showing an administrator login screen to the PC 60 (S100). The browser of the PC 60 that receives the web page data displays a screen shown by the web page data on the display of the PC 60. The user of the PC 60 can operate the screen displayed on the browser using the user I / F of the PC 60. Information showing the operation content on the browser is transmitted from the PC 60 to the MFP 10. The MFP 10 receiving information showing the operation content on the screen based on the web page data may simply be described as accepting an operation via the screen or being input via the screen. It may also be described as accepting an operation via the web page or being input via the web page. When the administrator login operation is accepted from the PC 60 via the administrator login screen and the administrator login is successful (S102: YES), the CPU 12 reads out parameters of the permitted domain list 43 (see FIG. 4) from the data storage area 36. The administrator login operation may be, for example, input of an administrator ID and a password. The parameters may be referred to as setting values. The parameters of the allowed domain list 43 may be simply referred to as the allowed domain list 43. The CPU 12 creates web page data showing an allowed list setting screen 70 (see FIG. 3, an example of an operation screen) based on the read allowed domain list 43, and transmits the web page data to the PC 60 (S104). Then, the allowed list setting screen 70 is displayed on the PC 60.

[0023] As shown in FIG. 3, the permission list setting screen 70 displays a combination of an allowed domain input field 72, a subdomain permission setting field 74, and an allowed distinct domain input field 76 for each row. As shown in FIG. 3, when explaining the input fields for each row, alphabets "a to c" are added after the reference numerals. The allowed domain input field 72 is a field for inputting an allowed domain that is a domain for which email sending is permitted. In FIG. 3, the allowed domain "brother.co.jp" is input in the allowed domain input field 72a, the allowed domain "brothergroup.net" is input in the allowed domain input field 72b, and the allowed domain "brother.ne.jp" is input in the allowed domain input field 72c.

[0024] The subdomain permission setting field 74 is a field for setting whether or not to permit email transmission to an email address of a subdomain of the permitted domain entered in the permitted domain input field 72 in the IFAX process and the ScanToEmail process. When email transmission to an email address of the subdomain is permitted, a check mark (R) is entered in the subdomain permission setting field 74. The permitted distinction domain input field 76 is a field for inputting a distinction domain of a permitted subdomain when email transmission to an email address of the subdomain is permitted without restriction. The permission list setting screen 70 also displays a selection field 78 above the permitted domain input field 72 for selecting at least one of the IFAX process and the ScanToEmail process. The permission list setting screen 70 also displays an email restriction notification setting field 79a and an administrator email address input field 79b above the permitted distinction domain input field 76.

[0025] The permission list setting screen 70 also includes a completion button (not shown). When the completion button is operated, the browser transmits the parameters input in each of the above-mentioned fields 72 to 79 to the MFP 10. The MFP 10 stores the received parameters in the memory 14 of FIG. 4. That is, when the administrator wants to register parameters, the administrator inputs the parameters to be registered in each of the fields 72 to 79 and presses the completion button. Then, when the setting on the permission list setting screen 70 is completed (S106: NO), the information set on the permission list setting screen 70 is stored in the data storage area 36 as a permission list such as the permitted domain list 43 as shown in FIG. 4 (S108). That is, the permitted domain list 43 is registered in the MFP 10. In this way, only the administrator of the MFP 10 can register the permitted domain list 43 in the MFP 10. The information shown in FIG. 4 is stored, for example, in a non-volatile area of ​​the data storage area 36. Note that a part or all of the information shown in FIG. 4 may be stored in a volatile area of ​​the data storage area 36.

[0026] 4 indicate whether or not there is an input in the selection field 78, and is set to ON when a check mark is input in the selection field 78, and is set to OFF when no check mark is input in the selection field 78. The permitted domain list 80c-g (permitted domain list 43) indicates the permitted domains input in the permitted domain input field 72. The sub-domain permission setting list 80h-l indicates whether or not there is an input in the sub-domain permission setting field 74, and is set to ON when a check mark is input in the sub-domain permission setting field 74, and is set to OFF when no check mark is input in the sub-domain permission setting field 74. The permitted distinct domain list 80m-q (permitted distinct domain list 44, an example of a permitted domain list) indicates the distinct domains input in the permitted distinct domain input field 76.

[0027] Furthermore, on a web page (not shown) provided by the EWS, the email subject and email body can be set when an email is sent in the IFAX process and the ScanToEmail process. When the email subject and email body are set on the web page, the email subject 80r and email body 80s are stored in the data storage area 36, ​​as shown in FIG.

[0028] 4 is a field for setting whether or not to enable a function for notifying the administrator of the MFP 10 by email that the email transmission is restricted based on the permitted domain list 43 (hereinafter, sometimes referred to as email restriction). When a check mark is input in the email restriction notification setting field 79a, the field is set to ON, and when a check mark is not input in the email restriction notification setting field 79a, the field is set to OFF. The administrator email address input field 79b is a field for inputting the email address of the administrator. When the email restriction notification setting field 79a and the administrator email address input field 79b are set, the email restriction notification setting 80u and the administrator email address 80t are stored in the data storage area 36. In the example shown in FIG. 4, the email restriction notification setting 80u is set to ON. In the administrator email address 80t, "admin@brother.com" is set as the email address of the administrator.

[0029] In addition, when the function of restricting email transmission by the permitted domain list 43 is enabled, information related to the email address (destination email address) that has been restricted from email transmission is stored in the data storage area 36 as registration candidate information (S157, S161, S166 in FIG. 9). Note that the restriction of email transmission may be described as a failure in transmission. In the example shown in FIG. 4, two pieces of registration candidate information 80v and 80w are stored, and each piece of information includes "user name of failed transmission", "email address of failed transmission", "date and time of failure in transmission", "whether or not there was a request to register the failed email address, etc.", and "error cause indicating the reason for failure in transmission". The domains included in the email addresses of the registration candidate information 80v and 80w are examples of the registration candidate domains of the present application. Note that the ON / OFF settings of each of the above-mentioned functions and the registration of the permitted domain list 43 may be accepted by the EWS or the touch panel of the input I / F 18.

[0030] Next, the display of the home screen, the login process, and the process involving email transmission in the standby state of the control program 34 will be described. The process of the control program 34 executed in the standby state and the like will be described with reference to the flowcharts shown in FIGS. 6 to 11. First, in the standby state, the control program 34 displays the home screen 100 (an example of an operation screen) shown in the upper part of FIG. 5 on the display 16 (S111). The MFP 10 displays the home screen 100 on the display 16, for example, when the power is turned on and the control program 34 is executed by the CPU 12 to start the system and then the display 16 is displayed, when the display 16 is displayed after the execution of any job is completed, or when some operation is performed on the user I / F 15 while the display 16 is hidden in the power saving mode and then the display 16 is displayed. The home screen 100 displays icons 102 corresponding to image processes that can be executed by the MFP 10. For example, the home screen 100 displays an icon 102a for executing a fax process, an icon 102b for executing a print process, and an icon 102c for executing a scan process.

[0031] Also, a login button 103 for performing a login operation is displayed at the top of the home screen 100. The state shown in Fig. 5 indicates a logout state in which no user has logged in, and the control program 34 displays the word "public" on the login button 103 in the logout state.

[0032] When the home screen 100 is displayed, the control program 34 judges whether the registration candidate information 80v, 80w is stored in the data storage area 36 (S113). If the registration candidate information 80v, 80w is stored (S113: YES), the control program 34 displays the message 105 on the home screen 100 (S115) and executes S117. If the registration candidate information 80v, 80w is not stored (S113: NO), the control program 34 executes S117. In S115, the control program 34 displays the home screen 100a shown in the lower part of FIG. 5. As shown in FIG. 5, the control program 34 displays the message 105 indicating the characters "!There is a list of failed email transmissions." In S117, if the login button 103 is operated (S117: YES), for example, a screen (not shown) for selecting a user to log in is displayed, and when the user to log in is selected, the control program 34 displays the login screen 110 (see FIG. 7) (S119). If the login button 103 is not operated (S117: NO), the control program 34 executes S125. The control program 34 accepts the login password on the login screen 110, and judges whether the login authentication is successful or not based on the selected user and password (S121). The user information and the login password are stored in advance in the data storage area 36. For example, they are accepted on a web page of the EWS, and stored for each user in the data storage area 36. Note that the message 105 may not be displayed before login, but may be displayed at another timing, for example, after the administrator logs in (S130: YES in FIG. 8). The method of login authentication is not limited to passwords, and may also be IC card or biometric authentication.

[0033] If the login authentication is successful (S121: YES), the login process is executed (S123), and if the login authentication is unsuccessful (S121: NO), S125 is executed. Although detailed explanation is omitted, the control program 34 executes a process according to the login user in response to the success of the login authentication. For example, the display of the login button 103 is changed from "public" to "login user name." In addition, execution authority may be set for each user who can log in, and the icons displayed on the home screen 100 after login and the executable functions may be changed according to the execution authority of the login user.

[0034] In the login process, as shown in FIG. 8, it is determined whether login has been performed by the administrator (S130), and if it is login by someone other than the administrator (S130: NO), the process of FIG. 8 is terminated. In this case, a process according to an operation on the home screen 100 by a login user other than the administrator is executed. Also, if login has been performed by the administrator (S130: YES), it is determined whether or not the registration candidate information 80v, 80w is stored in the data storage area 36 (S131). If the registration candidate information 80v, 80w is not stored (S131: NO), the process of FIG. 8 is terminated. In this case, since the process of registering the registration candidate information 80v, 80w from S132 onward is unnecessary, the process of FIG. 8 is terminated, and a process according to an operation on the home screen 100 by the administrator is executed.

[0035] If the registration candidate information 80v, 80w is stored (S131: YES), a transmission failure list screen 113 (see FIG. 7, an example of an operation screen) is displayed (S132). As shown in FIG. 7, the control program 34 reads out the registration candidate information 80v, 80w stored in the data storage area 36, ​​and displays each of the registration candidate information 80v, 80w as failure information 113a (an example of an operation object) on the transmission failure list screen 113. Of each of the registration candidate information 80v, 80w read out from the data storage area 36, ​​information on "transmission failure date and time, email address of transmission failure" is displayed as each failure information 113a. Note that in S131, if the registration candidate information 80v, 80w is stored in the data storage area 36, ​​and the registration candidate information 80v, 80w with "registered" as the information on "presence or absence of registration request" is stored, an affirmative determination may be made (S131: YES). In this case, if only the registration candidate information 80v, 80w of "no registration request" is stored (S131: NO), the process of Fig. 8 ends. Also, on the transmission failure list screen 113, only the registration candidate information 80v, 80w for which "registered" is stored as the information of "presence or absence of registration request" among the registration candidate information 80v, 80w stored in the data storage area 36 may be displayed as failure information 113a.

[0036] When S132 is executed, it is determined whether or not a process for registering in the permitted domain list 43 has been performed (S133). For example, as shown in Fig. 7, when any failure information 113a is selected on the transmission failure list screen 113, a registration confirmation screen 115 (an example of an operation screen) is displayed. In addition to the message "Do you want to register?", a YES button 115a (an example of an operation object) and a NO button 115b are displayed on the registration confirmation screen 115. If the YES button 115a is operated, an affirmative determination is made in S133 (S133: YES), a process for registering the domain or subdomain in the permitted domain list 43 (S135) is performed, and the process of Fig. 8 is terminated.

[0037] 7, the control program 34 displays a domain candidate list screen 116 (an example of an operation screen) displaying a registration candidate domain 116a, or a subdomain candidate list screen 117 displaying a registration candidate subdomain 117a, based on, for example, the error cause of the registration candidate information 80v, 80w. The registration candidate domain 116a is a domain that is a candidate for registration as an authorized domain in the permitted domain list 43, and is information on the domain of the email address of the registration candidate information 80v, 80w. The registration candidate subdomain 117a is a subdomain that is a candidate for registration as a distinguished domain in the permitted domain list 43, and is information on the subdomain of the email address of the registration candidate information 80v, 80w.

[0038] The error cause indicates the reason why the mail sending was restricted, and is information indicating whether the restriction was made at the domain level or the subdomain level. The domain level restriction means that the domain of the destination mail address is not registered as an allowed domain, and the mail sending is restricted. The subdomain level restriction means that the original domain of the destination mail address is registered as an allowed domain, but the entire domain of the destination mail address is not registered as a subdomain, and the mail sending is restricted. In other words, the original domain part matches (is registered), but the distinguishing domain indicating the subdomain does not match (is not registered), and thus the mail sending is restricted. Note that the subdomain is set based on the main domain, and is a domain in which an arbitrary character string is added before the main domain (described as the "original domain"). For example, if "bbb.com" is the original domain, the character string "sub" added before the original domain to make "sub.bbb.com" is a subdomain of "bbb.com".

[0039] 7 is selected and the cause of the error is at the domain level, the top-level domain "com" and the second-level domain "bbbb.com" of the email address of the registration candidate information 80v, 80w are displayed as the registration candidate domain 116a, as shown in the domain candidate list screen 116. Also, for example, if the email address of the failure information 113a (registration candidate information 80v, 80w) is "AAA@sub.bbbb.com", "bbbb.com" is registered as the permitted domain, and the cause of the error is at the subdomain level, the domain (subdomain) "sub.bbb.com" of the email address of the registration candidate information 80v, 80w is displayed as the registration candidate subdomain 117a, as shown in the subdomain candidate list screen 117.

[0040] When a registration candidate domain 116a is selected on the domain candidate list screen 116, the selected registration candidate domain 116a is registered in the permitted domain list 43 as a permitted domain, a registration completion screen is displayed, and S135 is terminated. When a registration candidate subdomain 117a is selected on the subdomain candidate list screen 117, the selected registration candidate subdomain 117a is registered in the permitted distinct domain list 44 (see FIG. 4) as a distinct domain, a registration completion screen is displayed, and S135 is terminated.

[0041] On the other hand, if the NO button 115b is operated on the registration confirmation screen 115, a negative determination is made in S133 (S133: NO), the registration candidate information 80v, 80w selected on the transmission failure list screen 113 is deleted from the data storage area 36 (S137), and the processing in Fig. 8 is terminated. As a result, the deleted registration candidate information 80v, 80w is deleted from the memory 14, and will no longer be displayed on the transmission failure list screen 113 in the subsequent processing. After S123 in Fig. 6 is executed, S125 is executed.

[0042] When the registration by the YES button 115a or the deletion by the NO button 115b is completed, the login state of the administrator may be maintained and the state may be returned to displaying the home screen 100. Alternatively, the logout state may be returned to display the home screen 100. When multiple pieces of registration candidate information 80v, 80w are stored, after the registration process of S135 or the deletion process of S137 is executed for any of the registration candidate information 80v, 80w, the transmission failure list screen 113 may be displayed again and the selection of another failure information 113a may be accepted. This allows the registration and deletion operations to be performed continuously for the remaining registration candidate information 80v, 80w.

[0043] In the above operation, when the login button 103 is operated (S117: YES), login authentication is performed using the login screen 110, and the registration candidate information 80v, 80w is registered. However, the registration process may be started based on another button operation. For example, when the message 105 is operated, the registration process may be started similarly. Specifically, for the message 105 displayed in S115, when this message 105 is operated before the administrator logs in, the processes of S119 to S123 may be executed. Also, when the message 105 is operated after the administrator logs in, the processes of S131 to S137 may be executed. Alternatively, the message 105 may be displayed after the administrator successfully logs in (S121: YES), and when the message 105 is operated, the processes of S131 to S137 may be executed.

[0044] Also, an icon for starting registration may be provided, and login authentication and registration may be performed based on the operation of the icon. Specifically, for example, the icon for starting registration may be displayed on the home screen 100, 100a, or on a screen transitioning from the home screen 100, 100a, regardless of whether the registration candidate information 80v, 80w is stored. Alternatively, the icon for starting registration may be displayed at the timing of displaying the message 105 described above. If the registration candidate information 80v, 80w is stored, the icon may be changed to a state indicating that the registration candidate information 80v, 80w is stored, for example, a state in which a badge is added. Then, if the icon is operated before the administrator logs in, the processes of S119 to S123 may be executed. If the icon is operated after the administrator logs in, the processes of S131 to S137 may be executed.

[0045] In S125, it is determined whether the icon 102a for sending mail has been operated. If not (S125: NO), the process from S111 is executed again. If the icon 102a has been operated (S125: YES), the scan process (S127) of the IFAX process is started. As a result, an input screen (not shown) for inputting the destination mail address in the IFAX process is displayed on the display 16. On this input screen, the user can manually input the mail address. Also, a telephone directory is stored in the data storage area 36 of the MFP 10, and one or more mail addresses can be registered in the telephone directory. Therefore, the user can select an arbitrary mail address from one or more mail addresses in the telephone directory stored in the data storage area 36 on the input screen. Also, a telephone directory can be stored in the server 50, and one or more mail addresses can be registered in the telephone directory. The CPU 12 can receive the mail address from the server 50. Therefore, the user can select an arbitrary mail address from one or more mail addresses in the telephone directory stored in the server 50 on the input screen. In this way, the user determines the destination email address for IFAX processing by manually inputting the email address or by selecting the email address from the phone book. Also, a start button is displayed on the input screen.

[0046] In the scan process, as shown in Fig. 9, the control program 34 first acquires the email address determined on the above-mentioned input screen (S141). The email address acquired in S141 is referred to as the acquired address. Next, the control program 34 refers to the setting information (see Fig. 4) stored in the data storage area 36 to determine whether the IFAX target setting is ON (S143). If the IFAX target setting is ON (S143: YES), that is, if the setting is set to execute the permission list matching process for the IFAX, the permission list matching process is executed (S145).

[0047] In the allow list collation process, as shown in FIG. 10, a domain (hereinafter referred to as "acquired domain") is acquired from the acquired address (S171). Next, a variable n is set to 1 (S173). Then, it is determined whether the acquired domain is an exact match with the allowed domain in the allowed domain list (n) in the allowed domain list 43 (hereinafter sometimes simply referred to as allowed domain list (n)) (S175). That is, it is determined whether the acquired domain is an exact match with "brother.co.jp" in the allowed domain list (1). At this time, for example, if the acquired domain is "brother.co.jp", it is determined that the allowed domain and the acquired domain are an exact match (S175: YES), the collation is successful (S177), and the process shown in FIG. 10 is terminated.

[0048] On the other hand, for example, if the acquired domain is a subdomain "ab.brother.co.jp" of "brother.co.jp", it is determined that the permitted domain list (1) and the acquired domain do not match completely (S175: NO). Then, it is determined whether the subdomain permission setting list (1) is ON (S179). Here, as shown in FIG. 4, since the subdomain permission setting list (1) is OFF (S179: NO), 1 is added to the variable n (S181). For this reason, if the acquired domain is a subdomain "ab.brother.co.jp" of "brother.co.jp", the match is not successful.

[0049] Next, in S181, 1 is added to the variable n, thereby setting the variable n to 2, and it is determined whether or not the variable n is greater than the maximum list value of the allowed domain list 43 (S183). The maximum list value is the number of allowed domains registered in the allowed domain list 43. As shown in Fig. 4, the number of registered allowed domains is three, so the maximum list value is three, and it is determined that the variable n is not greater than the maximum list value (S183: NO). Then, the process returns to S175.

[0050] In S175, it is determined whether the permitted domain list (2) and the acquired domain are a perfect match. In other words, it is determined whether the permitted domain list (2) "brothergroup.net" and the acquired domain are a perfect match. In this case, for example, if the acquired domain is "brothergroup.net", it is determined that the permitted domain (2) and the acquired domain are a perfect match (S175: YES), and the comparison is successful (S177).

[0051] On the other hand, for example, if the acquired domain is a subdomain "dp.brothergroup.net" of "brothergroup.net", it is determined that the allowed domain list (2) does not completely match the acquired domain (S175: NO). Then, it is determined whether the subdomain allowed setting list (2) is ON (S179). Here, as shown in FIG. 4, since the subdomain allowed setting list (2) is ON (S179: YES), the acquired domain is separated into an original domain and a differentiated domain (S185). That is, the acquired domain "dp.brothergroup.net" is separated into an original domain "brothergroup.net" and a differentiated domain "dp". The method of separation is not particularly limited, but for example, if there is a character string that completely matches the allowed domain list (n) from the top domain side of the acquired domain, the completely matched part may be the original domain and the remaining part may be the differentiated domain. If a domain that completely matches the allowed domain is not included, a negative determination may be made in the next S187. Alternatively, information required for separating unique domains, such as information on top-level domains, may be stored in advance in the data storage area 36, ​​or an inquiry may be made to the DNS or the like.

[0052] The unique domain separated from the acquired domain is referred to as the acquired unique domain, and the distinct domain separated from the acquired domain is referred to as the acquired distinct domain. Then, it is determined whether the acquired unique domain and the permitted domain list (2) are a perfect match (S187). Here, the acquired unique domain is "brothergroup.net" and the permitted domain list (2) is also "brothergroup.net", so it is determined that the acquired unique domain and the permitted domain list are a perfect match (S187: YES). Then, a subdomain matching process is executed (S189). The character string (e.g., "ap") added before the unique domain is referred to as the distinct domain. In other words, a subdomain is a domain consisting of a distinct domain (e.g., "ap") and an original domain (e.g., "brothergroup.net"). 4, the subdomain permission setting list corresponding to allowed domain list (1) "brother.co.jp" is OFF, and the subdomain permission setting list (2) and subdomain permission setting list (3) corresponding to allowed domain list (2) "brothergroup.net" and allowed domain list (3) "brother.ne.jp" are ON. By using this allowed domain list 43 in processing by the control program 34, sending of email to email addresses in the subdomain of "brother.co.jp" is restricted, and sending of email to email addresses in the subdomain of "brothergroup.net" or the subdomain of "brother.ne.jp" is not restricted. In other words, sending of scan data is permitted in the subdomains of "brothergroup.net" and "brother.ne.jp".

[0053] In the subdomain collation process, as shown in FIG. 11, it is determined whether or not the permitted distinct domain list (2) is set (S201). In FIG. 3, the distinct domains "ap" and "dp" are entered in the permitted distinct domain input field 76b corresponding to the permitted domain "brothergroup.net". This allows the sending of scan data to email addresses in the subdomains "ap.brothergroup.net" and "dp.brothergroup.net" without any restrictions. Then, as shown in FIG. 4, "ap" and "dp" are set in the permitted distinct domain list (2), so it is determined that the permitted distinct domain list (2) is set (S201: NO). Next, it is determined whether or not there is a domain in the permitted distinct domain list (2) that completely matches the acquired distinct domain (S203). Here, since "ap" and "dp" are set in the permitted distinct domain list (2) and the acquired distinct domain is "dp", it is determined that there is a domain in the permitted distinct domain list (2) that completely matches the acquired distinct domain (S203: YES), and the subdomain matching is successful (S205). In other words, the matching is successful for the subdomain "dp.brothergroup.net" of "brothergroup.net" that contains "dp". Furthermore, since "ap" is also set in the permitted distinct domain list (2), the matching is also successful for the subdomain "ap.brothergroup.net" of "brothergroup.net" that contains "ap". "brothergroup.net" is an example of a specific domain of the present application, and "ap" and "dp" are examples of designated subdomains. On the other hand, if the acquired distinct domain is other than "ap" and "dp", it is determined that there is no domain in the permitted distinct domain list (2) that completely matches the acquired distinct domain (S203: NO), and the subdomain matching is unsuccessful (S207). In other words, only the subdomains "dp.brothergroup.net" and "ap.brothergroup.net" are successfully matched, and the subdomains other than "dp.brothergroup.net" and "ap.brothergroup.net" are unsuccessful in matching. When the process of S205 or S207 is completed, the subdomain matching process ends.

[0054] When the subdomain matching process is completed, as shown in Fig. 10, it is determined whether or not the subdomain matching is successful (S191). If the subdomain matching is successful (S191: YES), the matching is successful (S177). On the other hand, if the subdomain matching is unsuccessful (S191: NO), 1 is added to the variable n in S181. At this time, the variable n is set to 3, and since the variable n (= 3) is not greater than the maximum value (= 3) of the permitted domain list (S183: NO), the process returns to S175.

[0055] In S175, it is determined whether the permitted domain list (3) "brother.ne.jp" and the acquired domain are a perfect match. In this case, for example, if the acquired domain is "brother.ne.jp", it is determined that the permitted domain list and the acquired domain are a perfect match (S175: YES), and the comparison is successful (S177).

[0056] On the other hand, for example, if the acquired domain is a subdomain "kp.brother.ne.jp" of "brother.ne.jp", it is determined that the acquired domain does not completely match the permitted domain list (3) (S175: NO). Here, as shown in FIG. 4, since the subdomain permission setting list (3) is ON, it is determined whether the acquired unique domain completely matches the permitted domain list (3) (S187). Since the acquired unique domain is "brother.ne.jp" and the permitted domain list (3) is also "brother.ne.jp", it is determined that the acquired unique domain completely matches the permitted domain list (S187: YES). Then, the subdomain matching process is executed (S189).

[0057] In the subdomain matching process, as shown in FIG. 11, it is determined whether or not the permitted distinguishing domain list (3) is set (S201). In FIG. 3, a distinguishing domain is not input in the permitted distinguishing domain input field 76c corresponding to the permitted domain "brother.ne.jp". Therefore, it is determined that the permitted distinguishing domain list (3) is not set (S201: YES). If a distinguishing domain is not input in the permitted distinguishing domain input field 76, all subdomains of the permitted domain corresponding to the permitted distinguishing domain input field 76 are permitted without restriction. In other words, sending of e-mail to e-mail addresses of all subdomains of the permitted domain "brother.ne.jp" is permitted without restriction. Therefore, when it is determined that the permitted distinguishing domain list (3) is not set (S201: YES), the subdomain matching is successful (S205). In other words, even if the distinguishing domain is not limited to "kp" but is any of "ap", "dp", etc., the subdomain of "brother.ne.jp" is permitted to be subdomain matched successfully. If the sub-domain permission setting field 74 is ON and no distinct domain is input in the permitted distinct domain input field 76, it may be determined that the sub-domain matching has failed.

[0058] 10, when the subdomain matching process is completed, it is determined whether or not the subdomain matching is successful, and if the subdomain matching is successful (S191: YES), the matching is successful (S177). On the other hand, for example, if the subdomain matching is unsuccessful (S191: NO), 1 is added to the variable n in S181. At this time, since the variable n (= 4) is greater than the maximum value in the list (= 3) (S183: YES), the matching is unsuccessful (S193). Then, the allowance list matching process is completed.

[0059] When the permission list comparison process is completed, as shown in FIG. 9, it is determined whether the comparison is successful (S147). If the comparison is successful (S147: YES), the e-mail is sent (S149). In S149, the scan process is performed to obtain the scan data. The e-mail subject and the e-mail body (see FIG. 4, 80r, 80s) are obtained from the data storage area 36, ​​and e-mail sending data with a job type of IFAX is created. This e-mail sending data includes the job type (IFAX), the obtained address, the e-mail subject, the e-mail body, and the scan data. The created e-mail sending data is sent by e-mail, and this flow ends. Note that, if the logged-in user is an administrator, the processes of S143, S145, and S147 may be skipped and S149 may be executed, that is, the restriction of e-mail sending by the permitted domain list 43 may not be executed.

[0060] Also, when executing e-mail transmission, for example, after the comparison in S145 is successful and scan data is obtained to create data for e-mail transmission, the permission list comparison process in S145 may be executed again. This allows the contents after the change in the permitted domain list 43, etc. to be reflected in the process from after S145 is executed until the scan data is created and data for e-mail transmission is created. That is, the latest settings can be reflected to restrict e-mail transmission. Alternatively, when e-mail transmission in S149 fails and e-mail transmission is to be resent, the permission list comparison process in S145 may be executed. This allows the contents after the change in the permitted domain list 43, etc. to be reflected in the process from after e-mail transmission fails until resent.

[0061] On the other hand, if the comparison fails (S147: NO), a message is displayed on the display 16 indicating that the domain comparison has resulted in an error and that the sending has been restricted (S151). As shown in the lower diagram of Fig. 12, a mail sending restriction screen 121 is displayed on the display 16 to indicate that the mail sending has been restricted. When the close button 121a on the mail sending restriction screen 121 is operated, a registration request confirmation screen 123 (see Fig. 12) is displayed to confirm the registration to the permitted domain list 43 (S153).

[0062] Next, the already stored registration candidate information 80v, 80w is read from the non-volatile area of ​​the data storage area 36 (S155), and the registration candidate information 80v, 80w related to the destination email address determined to have failed to match in S147 is stored as new registration candidate information 80v, 80w (S157). For the destination email address to which email sending is restricted, the "user name of the failed email transmission", "email address of the failed email transmission", "date and time of the failed email transmission", and "Error cause indicating the reason for the failed email transmission" are stored as new registration candidate information 80v, 80w.

[0063] "User name of failed transmission" is the user who operated icon 102a, and is the current user at the time when the email transmission failed. The current user is a public user if no user is logged in to MFP 10, and is the logged-in user if any user is logged in. "Email address of failed transmission" is the destination email address to which email transmission is restricted. "Date and time of failed transmission" is the date and time when the email transmission was restricted.

[0064] The "Error cause indicating the reason for failure in sending" is the reason for restricting the sending of the email, and is information indicating whether it is at the domain level or the subdomain level. If the subdomain matching process of S189 is not executed and the sending of the email is restricted, it is determined that the restriction is at the domain level. Specifically, for example, if all permitted domains do not match (S175: NO), and all subdomain permission setting lists (n) are OFF (S179: NO), matching is determined to have failed (S183: YES), and the sending of the email is restricted, it is determined that the restriction is at the domain level. Also, for example, even if the subdomain permission setting list (n) is ON (S179: YES), a negative determination is made in S187 for all acquired unique domains (S187: NO), and matching is determined to have failed, it is determined that the restriction is at the domain level.

[0065] In addition, when the subdomain matching process of S189 is executed and the sending of the e-mail is restricted, it is determined that the restriction is applied at the subdomain level. For example, when the result of executing S189 for at least one of all the permitted domains is that the matching has failed and the sending of the e-mail is restricted, it is determined that the restriction is applied at the subdomain level.

[0066] When the registration candidate information 80v, 80w is stored in S157, it is determined whether or not to issue a registration request (S159). The registration request confirmation screen 123 displays the message "Do you want to request registration of the target email address?", a YES button 123a (an example of a selected object), and a NO button 123b (an example of a selected object). When the YES button 123a is operated (S159: YES), information indicating "Request made" is stored in the data storage area 36 as information on "whether or not a failed request to register an email address, etc." of the new registration candidate information 80v, 80w (S161).

[0067] Next, it is determined whether the setting for notifying the administrator due to email restriction is enabled (S163). If the email restriction notification setting 80u in the data storage area 36 shown in FIG. 4 is ON (163: YES), an email is sent to the administrator (S165), and if it is OFF (S163: NO), the process in FIG. 9 is terminated. In S165, an email restriction notification email 125 (an example of a message) shown in FIG. 12 is sent to the administrator. The administrator email address 80t in the data storage area 36 is set as the destination email address, and a preset subject and text are set in the email restriction notification email 125. In addition, a link 125a for accessing an EWS transmission failure list screen 127 (see FIG. 13) is set in the text.

[0068] The subject and the contents of the message body are not particularly limited, but reference information for identifying the printer, such as the printer name or IP address of the MFP 10, may be set in the message body. The method of notifying the administrator of the registration request is not limited to using email, and may be, for example, a method of notifying the administrator using other messages, such as a chat message or a pop-up message via the printer driver software.

[0069] On the other hand, if the NO button 123b is operated on the registration request confirmation screen 123 and a registration request is not made (S159: NO), information indicating "no request" is stored in the data storage area 36 as information on "whether there was a failed request to register an email address, etc." of the new registration candidate information 80v, 80w (S166), the display of the registration request confirmation screen 123 is terminated (S167), and the process in Fig. 9 is terminated. In this case, no message is sent to the administrator, but the new registration candidate information 80v, 80w is stored in the data storage area 36.

[0070] As shown in Fig. 6, when the scan process (S127) is completed, S111 is executed. Then, if the registration candidate information 80v, 80w is stored in the data storage area 36 (S113: YES), the message 105 is displayed on the home screen 100a (see Fig. 5). Note that even if the registration candidate information 80v, 80w is stored, the message 105 does not always have to be displayed. For example, the message 105 may be displayed only when new registration candidate information 80v, 80w is stored between the previous display of the home screen 100 and the next display of the home screen 100.

[0071] Also, if the IFAX target setting is OFF in S143 (S143: NO), the process proceeds to S149 and skips the permission list checking process in S145. Therefore, if the IFAX target setting is OFF, the IFAX process is executed without checking the permission list of the acquired address. In other words, the transmission of the scan data in the IFAX process is executed without any restrictions, regardless of the email address.

[0072] Next, the ScanToEmail process will be described. When the ScanToEmail process is executed, the icon 102c is operated on the home screen 100 shown in FIG. 5. This causes an input screen for inputting the destination email address in the ScanToEmail process to be displayed on the display 16. On this input screen, the email address is set manually or from a phone book, as in the input screen in the IFAX process. A start button is displayed on the input screen, and by operating the start button, a positive determination is made in S125 (S125: YES), and the scan process is started (S127). The ScanToEmail process by the control program 34 at this time will be described with reference to the flowcharts shown in FIGS. 6 to 11. However, since the ScanToEmail process by the control program 34 is almost the same as the IFAX process by the control program 34 described above, only the differences will be described.

[0073] In the ScanToEmail process by the control program 34, the control program 34 determines in S143 whether the ScanToEmail target setting is ON. In addition, in S149, data for sending e-mail with a job type of ScanToEmail is created. Note that the processes other than these processes are the same as the IFAX process by the control program 34 described above. As a result, in the ScanToEmail process, it is possible to restrict the sending of scan data according to the permission list, just like in the IFAX process.

[0074] Next, a process on the failed transmission list screen 127 (an example of an operation screen or registration instruction screen) will be described. There are two ways to access the failed transmission list screen 127: accessing the link 125a of the mail restriction notification mail 125 described above, and logging in to the EWS as an administrator. In the former method, for example, when the link 125a of the mail restriction notification mail 125 shown in FIG. 12 is clicked, the PC 60 starts a browser and inputs the URL indicated by the link 125a into the browser. The browser to which the URL is input accesses the EWS and requests the failed transmission list screen 127 (a web page of the EWS) shown in FIG. 13. When a request to display the failed transmission list screen 127 is made, the CPU 12 functioning as the EWS transmits web page data (an example of image data) indicating the failed transmission list screen 127 to the PC 60. The browser of the PC 60 displays the screen indicated by the received web page data on the display, thereby displaying the failed transmission list screen 127. The process of registering a domain or the like using the failed transmission list screen 127 will be described later with reference to FIG. 15.

[0075] The latter method will be described with reference to FIG. 14. When, for example, a top page among web pages that manage the MFP 10 in the EWS is accessed, the control program 34 starts the process of FIG. 14. For example, when a request to display the top page is made, the CPU 12 functioning as the EWS transmits web page data (an example of image data) indicating the top page to the PC 60 (S211). The browser of the PC 60 displays a screen indicated by the received web page data on the display, thereby displaying the top page 131 (an example of an operation screen) shown in FIG. 12. A login button 131a is displayed on the top page 131. When login information is input and the login button 131a is operated, login authentication is performed, and when the authentication is successful, a post-login screen 133 (see FIG. 12, an example of an operation screen) after login is displayed.

[0076] If the login is not by the administrator (S213: NO), the process shown in FIG. 14 is terminated, and display process or the like according to the operation after login is executed. Also, if the login is by the administrator (S213: YES), the transmission list display button 133b (see FIG. 12) is displayed on the post-login screen 133 (S215). Also, a message 133a indicating that the registration candidate information 80v, 80w is stored in the memory 14 is displayed on the post-login screen 133. Next, it is determined whether the transmission list display button 133b has been operated (S217), and if it has not been operated (S217: NO), it is determined whether a logout operation has been performed (S219). If a logout operation has been performed (S219: YES), the process shown in FIG. 14 is terminated, and if it has not been operated (S219: NO), S217 is executed. Then, when the transmission list display button 133b is operated (S217: YES), the transmission failure list screen 127 shown in FIG. 13 is displayed (S220), and a registration process is executed using the transmission failure list screen 127 (S222).

[0077] Incidentally, even if the registration candidate information 80v, 80w is stored, the message 133a does not always have to be displayed. For example, the message 133a may be displayed only when new registration candidate information 80v, 80w is stored after the administrator logs in last time until the administrator logs in again. Also, the transmission failure list screen 127 may be displayed in response to an operation on the message 133a. Also, the transmission list display button 133b may be displayed on the post-login screen 133 for users other than the administrator. Also, when the registration candidate information 80v, 80w is stored, the transmission list display button 133b or the message 133a may be displayed on the top page 131.

[0078] FIG. 13 shows a transmission failure list screen 127. The screen shown in FIG. 13 is displayed when the administrator clicks on a link 125a in the received email, or when the administrator operates the browser after displaying a top page 131 in the browser. As shown in FIG. 13, the control program 34 reads out the registration candidate information 80v, 80w stored in the data storage area 36, ​​and displays the read information in each row. In FIG. 13, seven pieces of registration candidate information 80v, 80w are displayed as an example. In each row, "user name 137 for which transmission failed", "email address 138 for which transmission failed", "transmission failure date and time 139 for which transmission failed", "information 140 on the presence or absence of a registration request for the failed email address, etc.", and "error cause information 141 showing the reason for the transmission failure" are displayed.

[0079] Also, each row displays a check box 143. The check box 143 is used to select whether to register the domain (registration candidate domain 116a) or the subdomain (registration candidate subdomain 117a) in the permitted domain list 43 for the email address 138 of each of the registration candidate information 80v and 80w.

[0080] If the error cause is at the domain level, input into the domain check box 143 is enabled, and if it is at the subdomain level, the original domain (e.g., "fuga.jp") is displayed in the domain row, and input into the subdomain check box 143 is enabled. In other words, if there is a domain mismatch, domain registration is enabled, and if there is a subdomain mismatch, subdomain registration is enabled. Note that even in the case of the domain level, subdomain registration may be enabled.

[0081] By checking the information on the transmission failure list screen 127 shown in FIG. 13, the administrator can confirm and determine the domain and subdomain to be registered before starting registration, and can check the check box 143 of the domain, etc., that the user wants to register. In addition, the administrator can know the domain and subdomain that the user wants to register by checking whether there is a registration request. Then, by operating the Submit button 145 on the transmission failure list screen 127, the registration candidate information 80v, 80w that is checked in the check box 143 can be registered. In detail, in the registration process, as shown in FIG. 15, the control program 34 first determines whether the Submit button 145 has been operated (S231). If the Submit button 145 has been operated (S231: YES), it determines whether there is a row (registration candidate information 80v, 80w) with a check in the domain check box 143 (S233). If it is checked (S233: YES), S235 is executed, and if it is not checked (S233: NO), S237 is executed.

[0082] In S235, the unique domain of the email address of the row in which the domain checkbox 143 is checked, i.e., the information of the registration candidate domain 116a, is registered in the permitted domain list 43. In this case, all characters following @ (e.g., "hogehoge.jp") are registered as the registration candidate domain 116a. As in the process of FIG. 7, it may be possible to select whether to register only the top level domain (e.g., "jp") in addition to all characters following @. Also, in S237, it is determined whether there is a row in which the subdomain checkbox 143 is checked, and if it is checked (S237: YES), the subdomain of the checked row, i.e., the distinguishing domain of the registration candidate subdomain 117a (e.g., "mail" in FIG. 13) is registered in the permitted distinguishing domain list 44 (S239). This allows the domain or subdomain to be registered as a new permitted domain or distinguishing domain, where email transmission is restricted. If the negative judgment is made in S237 (S237: NO), or if S239 is executed, the process of FIG. 15 is terminated.

[0083] Next, as shown in FIG. 14, when the process of S222 is completed, the registration candidate information 80v, 80w is deleted (S223). For example, all the registration candidate information 80v, 80w displayed on the transmission failure list screen 127 is deleted from the data storage area 36, ​​and the process of FIG. 14 is terminated. The method of deleting the registration candidate information 80v, 80w is not limited to the above-mentioned method. For example, only the registration candidate information 80v, 80w for which the check box 143 of the domain or subdomain is checked, that is, the registration candidate information 80v, 80w for which registration has been completed, may be deleted from the data storage area 36. In this case, among the registration candidate information 80v, 80w for which the check box 143 is not checked, the registration candidate information 80v, 80w for the domain that matches the domain checked in the check box 143, or the registration candidate information 80v, 80w for the subdomain that matches the subdomain may be deleted. This allows other registration candidate information 80v, 80w that are permitted to send email by registration to be deleted all at once. Also, on the transmission failure list screen 127, the selection of the registration candidate information 80v, 80w (row) may be accepted, and the selected registration candidate information 80v, 80w may be deleted.

[0084] The above-mentioned method of registering the domain / subdomain in the permitted domain list 43 is just an example. For example, in addition to or instead of the check box 143, an input field in which the character strings of the domain and subdomain can be input may be provided in each row on the transmission failure list screen 127. Then, when the Submit button 145 is operated, the domain or subdomain input in the input field may be registered in the permitted domain list 43. In this case, the user can select or copy the desired domain or subdomain in the email address 138 field on the transmission failure list screen 127, and enter it in the input field by cut & paste to register it. The registration of the domain / subdomain can also be accepted on the above-mentioned permission list setting screen 70. The registration candidate information 80v, 80w, the registration candidate domain 116a, and the registration candidate subdomain 117a may be displayed on the permission list setting screen 70.

[0085] According to the above-described first embodiment, the following effects are achieved.

[0086] As described above, the control program 34 permits mail transmission when the acquired domain of the destination mail address matches the permitted domain (S175: YES), and restricts mail transmission when they do not match (S175: NO) (S193). When the acquired domain does not match the permitted domain, the control program 34 stores the acquired domain in the memory 14 as a registration candidate domain 116a (S157), and transmits a mail restriction notification mail 125 or a message 105, 133a indicating that the registration candidate domain 116a has occurred to the administrator of the MFP 10 (S165, FIG. 5, FIG. 12). Then, the registration candidate domain 116a stored in the memory 14 can be registered in the permitted domain list 43.

[0087] According to this, when scan data cannot be sent to a desired destination email address, the administrator can be requested and notified to register the acquisition domain of the destination email address to which the data could not be sent by the email restriction notification email 125 or the like. The administrator can confirm the requested registration candidate domain 116a by checking the email restriction notification email 125 or the like, and can determine whether or not to register the domain and perform the registration. This allows the administrator to ensure security by managing the permitted domain list 43 and restricting the destination. In addition, the user can notify the restricted registration candidate domain 116a to the administrator by the email restriction notification email 125 and request the registration quickly and smoothly. For example, when a user is unable to send emails that he / she was able to send from the organization he / she originally belonged to due to a change in the company organization, the user can inform the administrator that the permitted domain list 43 has restricted the emails and ask the administrator to modify the permitted domain list 43. In addition, by leaving the registration candidate domain 116a in the memory 14, the administrator can perform the registration work at a convenient time. Therefore, it is possible to achieve both ease of use of the scan mail function and improved security.

[0088] Furthermore, after sending the mail restriction notification mail 125 etc. to the administrator, when the MFP 10 receives a request from the administrator for the EWS permission list setting screen 70 or the transmission failure list screen 127, the MFP 10 transmits screen data for displaying the permission list setting screen 70 etc. to the requesting device (such as the PC 60). Then, when a registration instruction (such as an operation of the Submit button 145) is received via the permission list setting screen 70 etc., the MFP 10 registers the registration candidate domain 116a stored in the memory 14 in the permitted domain list 43. This allows the MFP 10 to display the permission list setting screen 70 or the transmission failure list screen 127 in response to a request from the administrator who has viewed the mail restriction notification mail 125 etc., and to accept an instruction to register the registration candidate domain 116a. The administrator can remotely instruct the MFP 10 to register the registration candidate domain 116a by operating the EWS permission list setting screen 70 or the transmission failure list screen 127, and update the permitted domain list 43.

[0089] Furthermore, a link 125a for accessing an EWS failed transmission list screen 127 is included in the email restriction notification email 125 sent to the administrator (see FIG. 12). In response to access to the link 125a, the failed transmission list screen 127 is displayed on the PC 60, and an instruction to register the registration candidate domain 116a is accepted via the failed transmission list screen 127. This allows the administrator to display the failed transmission list screen 127 and perform the registration work simply by accessing the link 125a in the email restriction notification email 125. This reduces the workload associated with the registration work.

[0090] Furthermore, the EWS can transmit screen data for displaying one of a plurality of operation screens (top page 131, post-login screen 133, transmission failure list screen 127, etc.) provided for different purposes to the PC 60. Then, a link 125a for accessing a transmission failure list screen 127 for receiving an instruction to register the registration candidate domain 116a in the permitted domain list 43 among the plurality of operation screens is included in the email restriction notification email 125 and transmitted. According to this, a link 125a for directly accessing a transmission failure list screen 127 for receiving an instruction to register the registration candidate domain 116a in the permitted domain list 43 among the plurality of operation screens provided in the EWS is included in the email restriction notification email 125 and transmitted. This can further reduce the workload associated with the registration work.

[0091] Furthermore, after sending the email restriction notification email 125, when a request to display the post-login screen 133 is received, a message 133a indicating that the registration candidate domain 116a is stored in the memory 14 is displayed on the PC 60. This allows the administrator to recognize that the registration candidate domain 116a is stored in the memory 14 by checking the post-login screen. This allows the administrator to quickly recognize the occurrence of the registration candidate domain 116a for which email sending is restricted.

[0092] Furthermore, when multiple pieces of registration candidate information 80v, 80w are stored in the memory 14, a list of the multiple pieces of registration candidate information 80v, 80w is displayed on the transmission failure list screen 127. When an instruction to register the registration candidate domain 116a in the permitted domain list 43 is received from the transmission failure list screen 127, the specified registration candidate domain 116a among the registration candidate domains 116a included in the list is registered in the permitted domain list 43. This allows the administrator to check multiple registration candidate domains 116a that have occurred in the past all at once. The administrator can collectively determine whether or not to register the multiple registration candidate domains 116a, and perform the registration work.

[0093] Also, the user I / F 15 can receive an instruction to register the registration candidate domain 116a in the permitted domain list 43 (see FIG. 7). According to this, when the administrator receives, for example, an email restriction notification email 125, he or she can move to the corresponding MFP 10 and operate the user I / F 15 to perform registration.

[0094] Also, a message 105 suggesting that the registration candidate domain 116a is stored in the memory 14 is displayed on the home screen 100. In response to an operation on the login button 103, an instruction to register the registration candidate domain 116a in the permitted domain list 43 is accepted (see FIG. 7). This makes it possible to suggest, via the user I / F 15 of the MFP 10, that the registration candidate domain 116a is stored in the memory 14. This makes it possible to notify the administrator, via the input I / F 18, of the occurrence of the registration candidate domain 116a for which email sending is restricted.

[0095] Furthermore, when the administrator logs in on the login screen 110, failure information 113a (transmission failure list screen 113) and a YES button 115a (registration confirmation screen 115) for approving the registration of the registration candidate domain 116a stored in the memory 14 in the permitted domain list 43 are displayed on the display 16. When an instruction such as the YES button 115a is received, the selected registration candidate domain 116a is registered in the permitted domain list 43. In this way, approval for registering the registration candidate domain 116a in the permitted domain list 43 can be given by an operation button displayed on the user I / F 15. By requesting an approval operation, the occurrence of registration errors can be suppressed.

[0096] In addition, a list of the registration candidate domains 116a stored in the memory 14 is displayed by the email address on the failed transmission list screen 113 and the registration candidate domains 116a on the domain candidate list screen 116. Then, among the email addresses and registration candidate domains 116a included in the list, the registration candidate domain 116a of the specified email address is registered in the permitted domain list 43. According to this, when multiple registration candidate domains 116a are stored in the memory 14, a list of the multiple registration candidate domains 116a is displayed on the failed transmission list screen 113 and the domain candidate list screen 116. This allows the administrator to check multiple registration candidate domains 116a that have occurred in the past all at once by the email address on the failed transmission list screen 113. The administrator can determine whether or not to register multiple registration candidate domains 116a and perform the registration work.

[0097] Even if the acquired domain does not match the permitted domain (S175: NO), if the acquired domain is a subdomain of the specific domain, the e-mail is sent (S191: YES). The subdomain is registered by accepting the designation in the permitted domain input field 76 of the permitted list setting screen 70, the subdomain candidate list screen 117 of the user I / F 15, or the subdomain check box 143 of the transmission failure list screen 127. Even if the subdomain fails to be collated (S193, S147: NO), the e-mail restriction notification e-mail 125 can be sent or the message 133a can be displayed (S165, FIG. 5, FIG. 12). Then, when a registration instruction for the registration candidate subdomain 117a of the registration candidate information 80v, 80w stored in the memory 14 is accepted from the administrator, the designated registration candidate subdomain 117a is registered in the permitted domain list 44.

[0098] According to this, even if the acquired domain does not match the permitted domain, if the acquired domain is a specified subdomain of a specific domain, mail transmission can be permitted. Also, subdomains permitted for mail transmission can be registered for a specific domain. If the acquired domain is a subdomain of a specific domain but is not a specified subdomain, mail transmission is restricted, but the acquired domain is stored in memory 14, and a mail restriction notification mail 125 is sent, etc. As a result, when an unregistered registration candidate subdomain 117a that is a subdomain of a specific domain but is not registered as a specified subdomain is restricted from transmission as an acquired domain, the registration candidate subdomain 117a can be registered as a new specified subdomain.

[0099] Also, when the acquired domain does not match the permitted domain (S147: NO), a registration request confirmation screen 123 (YES button 123a, NO button 123b) is displayed on the display 16 to select whether or not to send the mail restriction notification mail 125 to the administrator (S153). When the YES button 123a is selected, the acquired domain is stored in the memory 14 as the registration candidate domain 116a (S157) and the mail restriction notification mail 125 is sent (S165). When the NO button 123b is selected, the acquired domain is stored in the memory 14 (S157) but the mail restriction notification mail 125 is not sent (S159: NO). This allows the user to select whether or not to request the administrator to register the restricted acquired domain by message when mail transmission is restricted. Even if the message is not sent, the registration candidate domain 116a is left in the memory 14 so that the administrator can check the registration candidate domain 116a later.

[0100] Second embodiment Next, a second embodiment of the present application will be described. In the above-described first embodiment, the permitted domain list 43 is used to determine whether or not to restrict email transmission. In contrast, in the second embodiment, in addition to the permitted domain list 43, the permitted address list is used to determine whether or not to restrict email transmission. The second example is basically the same as the first embodiment, except for using the permitted address list. Therefore, the description of the same contents as the first embodiment will be omitted as appropriate.

[0101] As shown in FIG. 16, a permission list setting screen 170 (an example of an operation screen) of the second embodiment displays a permission address input field 151 in addition to the display items of the first embodiment. The permission address input field 151 is a field for inputting an email address (hereinafter, referred to as a permission address) that is permitted to send email. In FIG. 16, the permission address "taro.horita@brother.co.jp" is inputted in the permission address input field 151a, and the permission address "hanako.aichi@brother.co.jp" is inputted in the permission address input field 151b. The information set in the permission address input field 151 is stored in the data storage area 36 as a list of permission addresses (referred to as a permission address list) in the same manner as the permission domain list 43 (see FIG. 4). The number of permission addresses that can be registered is not limited.

[0102] FIG. 17 shows the permission list checking process of the second embodiment. The control program 34 of the second embodiment executes the processes in FIG. 6 and thereafter in the same manner as in the first embodiment, and when the permission list checking process (S14) of FIG. 9 is started, the control program 34 starts the permission list checking process of FIG. 17 instead of the permission list checking process of FIG. 10. As shown in FIG. 17, first, the control program 34 judges whether the acquired address acquired in S141 of FIG. 9 is included in the permission address list of the data storage area 36 (S241). For example, if an authorized address that completely matches the acquired address is set in the authorization address list (S241: YES), the control program 34 judges that the checking is successful (S177), ends the process of FIG. 17, and executes S147 of FIG. 9. This allows the authorized addresses included in the authorization address list to send email.

[0103] On the other hand, if the acquired address does not completely match the permitted address included in the permitted address list (S241: NO), S171 and subsequent steps are executed, and the same process as in Fig. 10 of the first embodiment is executed. As a result, for the acquired address not included in the permitted address list, the permitted domain list 43 determines whether it matches the permitted domain in the permitted domain list 43 or the subdomain in the permitted distinction domain list 44, and determines whether to restrict email sending.

[0104] In the above description, when the address is acquired in S141, a check is performed against the permitted address list, but this is not limited to the above. For example, after the scan data is created by the scanner 20 in S149, a check against the permitted address list and the permitted domain list 43 may be performed. Also, when an email transmission fails and is to be resent, a check against the permitted address list and the permitted domain list 43 may be performed.

[0105] In the second embodiment, similar to the registration candidate domain 116a and the registration candidate subdomain 117a in the first embodiment, a process is executed to register a destination email address restricted from sending email by the permitted address list as a permitted address in the permitted domain list. Specifically, when email sending is restricted, the email address is stored as registration candidate information 80v, 80w (S157). The email address included in this registration candidate information 80v, 80w is an example of the registration candidate email address of the present application.

[0106] For example, in the case of registration using the user I / F 18 in Fig. 7, when the YES button 115a is selected on the registration confirmation screen 115, the entire email address (e.g., AAA@bbb.com) is displayed as a selectable candidate email address for registration in addition to the registration candidate domain 116a on the domain candidate list screen 116. When an email address is selected, it is assumed that an instruction to register the registration candidate email address (AAA@bbb.com) has been accepted (S133: YES in Fig. 8), and the registration candidate email address is registered in the permitted address list (S135).

[0107] Also, notification of the candidate email address for registration can be performed by sending the email restriction notification email 125 or the messages 105 and 133a, as in the first embodiment. That is, by sending these messages, the administrator can be notified that the candidate email address for registration is stored in the memory 14.

[0108] Registration of candidate email addresses for registration is also accepted on the transmission failure list screen 127 shown in Fig. 13. For example, a column of email address check boxes 143 is provided between the column for error cause and the column for domain. This check box 143 is for issuing an instruction to register the email address on the same row, i.e., the candidate email address for registration, in the permitted address list.

[0109] 18 shows the registration process of the second embodiment. For example, if the error cause is at the domain level, input of the email address and domain into the check box 143 is enabled, and if it is at the subdomain level, input of the subdomain into the check box 143 is enabled. That is, in the case of a mismatch in the permitted address or a mismatch in the domain, registration of the email address or domain is enabled, and in the case of a mismatch in the subdomain, registration of the subdomain is enabled.

[0110] When the Submit button 145 on the transmission failure list screen 127 is operated (S231: YES in FIG. 18), if the check box 143 of the email address is checked (S243: YES), the control program 34 registers the checked registration candidate email address in the permitted address list (S245). As shown in FIG. 18, if the error factor is at the domain level, and the Submit button 145 is operated with both the email address and domain check boxes checked, both the registration of the registration candidate email address in the permitted address list (S245) and the registration of the registration candidate domain 116a in the permitted domain list 43 (S235) may be accepted. Also, when the two check boxes for the email address and domain are displayed, only one of them may be selected. In this case, when S245 is executed, S233 and S235 may be skipped and S237 may be executed.

[0111] According to the above-described second embodiment, the same effects as those of the first embodiment are achieved. Moreover, the second embodiment achieves the following effects.

[0112] As described above, the MFP 10 of the second embodiment can set an authorized address list that allows email transmission, and transmits scan data if the destination email address is included in the authorized address list, and restricts email transmission if the destination email address is not included. If the destination email address is not included in the authorized address list, the destination email address is stored in the memory 14 as a registration candidate email address, and an email restriction notification email 125 is sent to the administrator. The registration candidate email address stored in the memory 14 can then be registered in the authorized address list. This allows the administrator to be requested to register the acquired address by the email restriction notification email 125 or the like. By leaving the registration candidate email addresses in the memory 14, the administrator can perform the registration work at a convenient time.

[0113] Incidentally, the above-described embodiment is merely one example of the present invention, and it goes without saying that the embodiment of the present invention can be modified as appropriate without departing from the gist of the present invention. For example, the execution order of each process described above can be changed as appropriate without changing the gist of the present invention. In other words, the present invention can be embodied in various forms with various modifications and improvements based on the knowledge of a person skilled in the art. Specifically, for example, in the above-mentioned second embodiment, the comparison is performed using both the permitted domain list 43 and the permitted address list, but the comparison may be performed using only the permitted address list. For example, when the control program 34 makes a negative judgment at S241 in FIG. 17 (S241: NO), the control program 34 may skip S171 and thereafter, execute S193 to judge the comparison as unsuccessful, and end the process of FIG. 17. In this way, when the acquired address is acquired (S145), the comparison can be performed using only the permitted address list. Note that, after the scan data is created (S145) or when the mail is resent, the comparison can be performed using only the permitted address list. Also, the comparison can be performed in combination, such as performing both comparisons at least at one of the times of acquiring the acquired address, creating the scan data, and resending the mail, and performing one of the comparisons in the remaining processes. In the second embodiment described above, a check is first performed using the permitted address list (S241), and if the check is unsuccessful using the permitted address list, a check is performed using the permitted domain list 43 (S171 and subsequent steps). However, it is also possible to first perform a check using the permitted domain list 43, and if the check is unsuccessful, a check is performed using the permitted address list. Furthermore, in each embodiment, restrictions on email transmission are implemented based on permitted domains and subdomains, but restrictions may be implemented only based on permitted domains.

[0114] In the first embodiment, the permitted domain input field 72, the subdomain permission setting field 74, and the permitted distinct domain input field 76 are displayed on the permission list setting screen 70, but the permitted domain input field 72 and the subdomain permission setting field 74 may be displayed without displaying the permitted distinct domain input field 76. In this case, all subdomains of the permitted domain checked in the subdomain permission setting field 74 are set as subdomains to which scan data can be sent. In addition, the permitted list setting screen 70 may not display the subdomain permission setting field 74, but instead display the permitted domain input field 72 and the permitted distinct domain input field 76. In such a case, subdomains including the distinct domain entered in the permitted distinct domain input field 76 are set as subdomains to which scan data can be sent.

[0115] Furthermore, in the first embodiment, the entire email address is stored in the memory 14 as the registration candidate information 80v, 80w, but only the domain may be stored. In addition, although all registration candidate information (registration candidate domains 116a, registration candidate email addresses) registered in memory 14 is displayed on transmission failure list screen 113, it is also possible to display only those for which registration was requested in S159. Also, the transmission failure list screen 127 may display only those for which a registration request has been made. Furthermore, the link 125a is not limited to a link for directly accessing the transmission failure list screen 127, but may be a link for accessing another operation screen such as a top page 131 or the like. The access destination of the link 125a may be the permission list setting screen 70, 170. The registration of the registration candidate information 80v, 80w (registration candidate domain 116a, registration candidate subdomain 117a, registration candidate email address) may be accepted on the permission list setting screen 70, 170. Moreover, the link 125 a does not need to be written in the mail restriction notification mail 125 . In each embodiment, registration of domains, subdomains, and email addresses is accepted by both the EWS and the user I / F 15, but registration may be accepted by only one of them. In the above embodiments, the CPU 12 executes the processes shown in Figures 2, 6, 8 to 11, 14, 15, 17, and 18. However, these processes may be executed by ASIC or other logic integrated circuits, not limited to the CPU 12, or may be executed by cooperation between the CPU, ASIC, and other logic integrated circuits. These devices that process in place of the CPU 12 or devices that process in cooperation with the CPU 12 are examples of the controller of the present application. A combination of the CPU 12 and a part of the memory 14, such as a buffer, may also be an example of a controller. [Explanation of symbols]

[0116] 10: MFP, 12: CPU, 14 memory, 15 user I / F, 18 input I / F, 20: scanner, 28: network I / F, 43 permitted domain list, 44 permitted domain list by category, 70, 170 permitted list setting screen, 100 home screen, 105, 133a message, 110 input screen, 116 domain candidate list screen, 116a registration candidate domain, 125a link, 113 failed sending list screen, 113a failure information, 115 registration confirmation screen, 115a YES button, 123a YES button, 123b NO button, 125 email restriction notification email, 127 failed sending list screen, 131 top page, 133 post-login screen.

Claims

1. An image forming apparatus comprising a user interface, a communication interface, a controller, and a scanner, The controller: When sending scan data formed by the scanner by email, the image forming apparatus is configured to transmit the scan data via the communication interface by email when an acquired domain matches an authorized domain, and to restrict the email transmission of the scan data when the acquired domain does not match an authorized domain, the acquired domain being a domain included in a destination email address of the email transmission, and the authorized domain being a domain included in an authorized domain list that is registered in advance in the image forming apparatus; The controller: When the acquired domain does not match the permitted domain, the acquired domain is stored in a memory as a registration candidate domain, and a message indicating that the registration candidate domain has been generated is transmitted to an administrator of the image forming apparatus, the registration candidate domain being a domain that is a candidate for registration as the permitted domain in the permitted domain list; The controller: An image forming apparatus configured to be able to register the registration candidate domains stored in the memory in the permitted domain list.

2. The user interface includes: a remote user interface configured to, when receiving a request for an operation screen from the administrator via the communication interface, transmit screen data for displaying the operation screen to a requesting device, and receive an instruction via the operation screen from the device that has received the screen data; The controller:

2. The image forming apparatus according to claim 1, further comprising: a device that receives a request for the operation screen from the administrator via the communication interface after sending the message to the administrator; a device that receives the message, and transmits the screen data for displaying the operation screen to the device that made the request; and a device that receives the screen data, and a device that receives an instruction to register the registration candidate domain stored in the memory in the permitted domain list via the operation screen, the image forming apparatus being configured to register the registration candidate domain stored in the memory in the permitted domain list.

3. The controller: sending the message to the administrator including a link for accessing the operation screen of the remote user interface; after transmitting the message to the administrator, when a request to access the operation screen using the link included in the message is received via the communication interface, screen data for displaying the operation screen is transmitted to a requesting device; 3. The image forming apparatus according to claim 2, further comprising: a display unit configured to display a display image of the display unit that displays the display image of the display unit; a display unit configured to display the display image of the display unit that displays the display image of the display unit;

4. The remote user interface includes: The screen data is configured to transmit to a request source device the screen data for displaying any one of a plurality of operation screens provided for different purposes, The controller: sending, in the message to be sent to the administrator, a link for accessing a registration instruction screen, which is an operation screen for receiving an instruction to register the registration candidate domain stored in the memory in the permitted domain list, among a plurality of operation screens provided for different purposes; after transmitting the message to the administrator, when a request to access the registration instruction screen using the link included in the message is received via the communication interface, the screen data for displaying the registration instruction screen is transmitted to a requesting device; 3. The image forming apparatus according to claim 2, further comprising: a display unit configured to display a display image of the display unit that displays the display image of the display unit; a display unit configured to display the display image of the display unit that displays the display image of the display unit;

5. The controller:

3. The image forming apparatus according to claim 2, further comprising: when a request for the operation screen is received from the administrator via the communication interface after sending the message to the administrator, screen data for displaying the operation screen indicating that the registration candidate domain is stored in the memory is sent to the requesting device; and when an instruction to register the registration candidate domain stored in the memory in the permitted domain list is received from the device that received the screen data, the image forming apparatus is configured to register the registration candidate domain stored in the memory in the permitted domain list.

6. The controller:

3. The image forming apparatus of claim 2, further comprising: an operation screen display unit configured to display, when a request for the operation screen is received from the administrator via the communication interface after sending the message to the administrator, image data for displaying the operation screen including a list of the registration candidate domains stored in the memory to the requesting device; and when a registration instruction to the permitted domain list is received from the device that received the screen data, the specified registration candidate domain among the registration candidate domains included in the list is registered in the permitted domain list.

7. The user interface includes: an operation panel provided in the image forming apparatus, configured to display the operation screen when a request for the operation screen is received from the administrator, and configured to receive instructions from the administrator via the operation screen; The controller:

2. The image forming apparatus of claim 1, configured to: after sending the message to the administrator, when a request for the operation screen is received from the administrator via the operation panel, display the operation screen on the operation panel; and when an instruction to register the registration candidate domain stored in the memory in the permitted domain list is received via the operation screen, register the registration candidate domain stored in the memory in the permitted domain list.

8. The controller: After transmitting the message to the administrator, displaying on the operation panel a screen indicating that the registration candidate domain is stored in the memory; 8. The image forming apparatus according to claim 7, further comprising: a display unit configured to display a display screen on the operation panel; and a display unit configured to display a display screen on the operation panel; and a display unit configured to display a display screen on the operation panel;

9. The controller: after transmitting the message to the administrator, when a request for the operation screen is received from the administrator via the operation panel, the operation screen including an operation object for approving the registration of the registration candidate domain stored in the memory in the permitted domain list is displayed on the operation panel; 8. The image forming apparatus according to claim 7, configured to register the registration candidate domain in the permitted domain list when an instruction is received via the operation object after the operation screen is displayed on the operation panel.

10. The controller: after transmitting the message to the administrator, when a request for the operation screen is received from the administrator via the operation panel, the operation screen including a list display of the registration candidate domains stored in the memory is displayed on the operation panel; 8. The image forming apparatus of claim 7, wherein when an instruction to register one of the registration candidate domains included in the list to the permitted domain list is received after displaying the operation screen including the list of the registration candidate domains on the operation panel, the image forming apparatus is configured to register the specified registration candidate domain from among the registration candidate domains included in the list to the permitted domain list.

11. The controller: Even if the acquired domain does not match the allowed domain, if the acquired domain is a subdomain of a specific domain, the scanned data is transmitted by email, and the specific domain is a specific one of the allowed domains included in the allowed domain list, The controller: a method for registering a specified subdomain in the permitted domain list when an operation for specifying an arbitrary subdomain of the specific domain is received via the user interface, the specified subdomain being a subdomain specified by the operation; The controller: if the acquired domain is a subdomain of the specific domain registered in the permitted domain list, and the acquired domain is the designated subdomain registered in the permitted domain list, the scanned data is sent by email, and if the acquired domain is not the designated subdomain registered in the permitted domain list, the email sending of the scanned data is restricted, the subdomain that is the acquired domain is stored in the memory, and the message is sent to the administrator; 2. The image forming apparatus according to claim 1, configured to register a subdomain stored in the memory to the allowed domain list as a subdomain designated for the specific domain included in the allowed domain list when an instruction to register a subdomain stored in the memory to the allowed domain list is received from the administrator via the user interface.

12. The controller: displaying a selection object on the operation panel for selecting whether or not to transmit the message to the administrator when the acquired domain does not match the authorized domain; 8. The image forming apparatus of claim 7, configured to, when a selection to send the message is received at the selection object via the operation panel, store the acquired domain in the memory as the registration candidate domain and send the message, and when a selection not to send the message is received at the selection object via the operation panel, store the acquired domain in the memory as the registration candidate domain while restricting the sending of the message.

13. An image forming apparatus comprising a user interface, a communication interface, a controller, and a scanner, The image forming apparatus includes: A list of permitted addresses can be set, which is a list of email addresses to which email transmission of the scan data formed by the scanner is permitted, The controller: When sending the scanned data by email, the scan data is sent by email via the communication interface when a destination email address for email transmission is an email address included in the permitted address list, and the email transmission of the scan data is restricted when the destination email address is an email address not included in the permitted address list, The controller: When the destination email address is an email address not included in the permitted address list, the destination email address is stored in a memory as a candidate email address for registration, and a message indicating that the candidate email address for registration has been generated is sent to an administrator of the image forming device, the candidate email address for registration being an email address that is a candidate for registration in the permitted address list; The controller: The image forming apparatus is configured so that the registration candidate email address stored in the memory can be registered in the permitted address list.

14. The user interface includes: a remote user interface configured to, when receiving a request for an operation screen from the administrator via the communication interface, transmit screen data for displaying the operation screen to a requesting device, and receive an instruction via the operation screen from the device that has received the screen data; The controller:

14. The image forming apparatus of claim 13, further comprising: a display unit configured to display a display image of the operation screen of the requesting device when the display unit receives a request for the operation screen from the administrator via the communication interface after sending the message to the administrator; and a display unit configured to display a display image of the operation screen of the requesting device when the display unit receives an instruction to register the registration candidate email address stored in the memory to the permitted address list via the operation screen from the device that received the screen data.

15. The controller: sending the message to the administrator including a link for accessing the operation screen of the remote user interface; after transmitting the message to the administrator, when a request to access the operation screen using the link included in the message is received via the communication interface, screen data for displaying the operation screen is transmitted to a requesting device; The image forming apparatus according to claim 14, further configured to register the candidate email address stored in the memory to the permitted address list when an instruction to register the candidate email address stored in the memory to the permitted address list is received via the operation screen from a device that has received the screen data.

16. The remote user interface includes: The screen data is configured to transmit to a request source device the screen data for displaying any one of a plurality of operation screens provided for different purposes, The controller: sending, in the message to be sent to the administrator, a link for accessing a registration instruction screen, which is an operation screen for receiving an instruction to register the registration candidate email address stored in the memory to the permitted address list, among a plurality of operation screens provided for different purposes; after transmitting the message to the administrator, when a request to access the registration instruction screen using the link included in the message is received via the communication interface, the screen data for displaying the registration instruction screen is transmitted to a requesting device; The image forming apparatus according to claim 14, further configured to register the candidate email address stored in the memory to the permitted address list when an instruction to register the candidate email address stored in the memory to the permitted address list is received from a device that receives the screen data via the registration instruction screen.

17. The controller:

15. The image forming apparatus of claim 14, further comprising: a device that receives a request for the operation screen from the administrator via the communication interface after sending the message to the administrator; a device that receives the request sends screen data for displaying the operation screen indicating that the registration candidate email address is stored in the memory; and a device that receives the screen data sends an instruction to register the registration candidate email address stored in the memory to the permitted address list; and a device that receives the screen data sends screen data to the device that sent the request, the screen data being used to register the registration candidate email address stored in the memory to the permitted address list.

18. The controller:

15. The image forming apparatus of claim 14, further comprising: an operation screen display unit configured to display, when a request for the operation screen is received from the administrator via the communication interface after sending the message to the administrator, image data for displaying the operation screen including a list of the registration candidate email addresses stored in the memory to the requesting device; and when a registration instruction to the permitted address list is received from the device that received the screen data, the specified registration candidate email address from the registration candidate email addresses included in the list is registered in the permitted address list.

19. The user interface includes: an operation panel provided in the image forming apparatus, configured to display the operation screen when a request for the operation screen is received from the administrator, and configured to receive instructions from the administrator via the operation screen; The controller:

14. The image forming apparatus of claim 13, further comprising: a display unit configured to display the operation screen on the operation panel when a request for the operation screen is received from the administrator via the operation panel after the message is sent to the administrator; and a display unit configured to display the operation screen on the operation panel when an instruction to register the registration candidate email address stored in the memory to the permitted address list is received via the operation screen.

20. The controller: After transmitting the message to the administrator, a screen indicating that the registration candidate email address is stored in the memory is displayed on the operation panel; 20. The image forming apparatus of claim 19, further comprising: a display screen on the operation panel; and when an instruction to register the candidate email address stored in the memory to the permitted address list is received via the operation screen, the image forming apparatus is configured to register the candidate email address stored in the memory to the permitted address list.

21. The controller: when a request for the operation screen is received from the administrator via the operation panel after the message has been sent to the administrator, the operation screen including an operation object for approving the registration of the registration candidate email address stored in the memory to the permitted address list is displayed on the operation panel; 20. The image forming apparatus according to claim 19, wherein the operation screen is displayed on the operation panel, and then when an instruction is received via the operation object, the registration candidate email address is registered in the permitted address list.

22. The controller: after transmitting the message to the administrator, when a request for the operation screen is received from the administrator via the operation panel, the operation screen including a list display of the registration candidate email addresses stored in the memory is displayed on the operation panel; 20. The image forming apparatus of claim 19, wherein when an instruction to register one of the registration candidate email addresses included in the list to the permitted address list is received after displaying the operation screen including a list of the registration candidate email addresses on the operation panel, the specified registration candidate email address among the registration candidate email addresses included in the list is registered to the permitted address list.

Images