Image forming device

Abstract

To provide an image forming device capable of combining convenience of a scan mail function with improvement of security.SOLUTION: A device constructs a permitted domain list 43b which sets a permitted domain associated with a group which a log-in user belongs to, and determines whether the permitted domain in the permitted domain list 43b and the domain of a transmission destination mail address match. The device restricts the mail transmission when they do not match but permits the mail transmission when they match. This makes it possible to execute restriction of mail transmission in accordance with a group which a user using a MFP 10 belongs to.SELECTED DRAWING: Figure 12

Description

[Technical field]

[0001] The present invention relates to an image forming apparatus having a function of sending scan data formed by a scanner by email. [Background technology]

[0002] The following Patent Document 1 describes an image forming apparatus having a scan-to-mail function for sending scan data formed by a scanner by email. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2007-214962 A Summary of the Invention [Problem to be solved by the invention]

[0004] In an image forming apparatus equipped with a scan mail function, such as the image forming apparatus described in Patent Document 1, it is necessary to restrict the destination of mail from a security standpoint, but excessive restrictions may lead to a decrease in usability. Therefore, an object of the present invention is to provide an image forming apparatus that achieves both ease of use of the scan mail function and improved security. [Means for solving the problem]

[0005] In order to solve the above problem, an image forming apparatus disclosed in an embodiment is an image forming apparatus including a communication interface, a controller, and a scanner, and the controller is configured to, when sending scan data formed by the scanner by email, send the scan data via the communication interface if an acquired domain matches an authorized domain, and to restrict the email sending of the scan data if the acquired domain does not match the authorized domain, the acquired domain is a domain included in a destination email address of the email sending, and the authorized domain is a domain included in an authorized domain list that is registered in advance in the image forming apparatus, the image forming apparatus is capable of registering a plurality of groups to which a plurality of users that can log in can belong, and the authorized domain is a domain included in a destination email address of the email sending destination, the image forming apparatus is capable of registering a plurality of groups to which a plurality of users that can log in can belong, and the image forming apparatus is configured to restrict the email sending of the scan data if an acquired domain matches an authorized domain. the login list can be set to correspond to one of a plurality of groups with the permitted domain included in the permitted domain list, and the controller is configured to restrict the email transmission of the scan data when the acquired domain matches the permitted domain but the permitted domain does not correspond to the group to which the login user belongs in the permitted domain list and the acquired domain, and not to restrict the email transmission of the scan data when the acquired domain matches the permitted domain and the permitted domain that corresponds to the group to which the login user belongs in the permitted domain list and the acquired domain, and the login user is a user who is logged in to the image forming apparatus.

[0006] In order to solve the above problem, an image forming apparatus disclosed in an embodiment is an image forming apparatus including a communication interface, a controller, and a scanner, the image forming apparatus is capable of setting an allowed address list which is a list of email addresses to which email transmission of scan data formed by the scanner is permitted, the controller is configured to, when emailing the scan data, email the scan data if the destination email address of the email transmission is an email address included in the allowed address list, and to restrict the email transmission of the scan data if the destination email address is an email address not included in the allowed address list, the image forming apparatus is capable of registering a plurality of groups to which a plurality of users who can log in can belong, and The allowed address list can be set to correspond to one of a plurality of groups with an email address included in the allowed address list, and the controller is configured to restrict the email sending of the scan data when the destination email address is an email address included in the allowed address list but does not correspond in the allowed address list to the group to which the logged-in user belongs, and to not restrict the email sending of the scan data when the destination email address is an email address included in the allowed address list and corresponds in the allowed address list to the group to which the logged-in user belongs, and the login user is a user who is logged in to the image forming device. Effect of the Invention

[0007] The image forming apparatus disclosed in the embodiment can achieve both ease of use of the scan mail function and improved security. [Brief description of the drawings]

[0008] [Figure 1] 1 is a block diagram of a communication system according to a first embodiment. [Diagram 2]FIG. 4 is a flowchart of the control program 34. [Diagram 3] FIG. 7 is a diagram showing a permission list setting screen 70. [Figure 4] 13 is a diagram showing an example of data stored in non-volatile area 36b and its storage address. FIG. [Diagram 5] FIG. 1 shows a home screen 100. [Figure 6] FIG. 4 is a flowchart of the control program 34. [Figure 7] FIG. 4 is a flowchart of the control program 34. [Figure 8] FIG. 4 is a flowchart of the control program 34. [Figure 9] 1A and 1B are diagrams showing input screens 110 and 111a and a destination selection screen 111b. [Figure 10] FIG. 4 is a flowchart of the control program 34. [Figure 11] FIG. 4 is a flowchart of the control program 34. [Figure 12] FIG. 4 shows an address book 41b when userA and userB are both logged in. [Figure 13] FIG. 4 is a flowchart of the control program 34. [Figure 14] FIG. 4 is a flowchart of the control program 34. [Figure 15] FIG. 4 is a flowchart of the control program 34. [Figure 16] FIG. 4 is a flowchart of the control program 34. [Figure 17] FIG. 4 is a flowchart of the control program 34. [Figure 18] FIG. 4 is a flowchart of the control program 34. [Figure 19] FIG. 11 is a diagram showing a permission list setting screen 170 according to the second embodiment. [Figure 20] 13 is a diagram showing an example of data stored in a non-volatile area 36b according to the second embodiment and its storage address. FIG. [Figure 21] FIG. 11 is a flowchart of a control program 34 according to the second embodiment. [Figure 22] FIG. 13 is a diagram showing a permitted address list 85b in a case where userA and userB have both logged in according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] (First embodiment) A first embodiment of the present invention will be described below with reference to the accompanying drawings. Fig. 1 is a block diagram of a communication system according to the first embodiment. The communication system shown in Fig. 1 includes an MFP (an example of an image forming apparatus) 10, a server 50, and a PC 60.

[0010] The MFP 10 mainly comprises a CPU (an example of a controller) 12, a memory 14, a user I / F 15, a scanner 20, a printer 22, a modem 24, and a network I / F 28 (an example of a communication interface). I / F is an abbreviation of interface. These components are capable of communicating with each other via a bus 32.

[0011] The CPU 12 executes processing according to a control program 34 in the memory 14. The CPU 12 also functions as a web server by executing processing according to an EWS (embedded web server) program 35. The web server realized by the CPU 12 operating according to the EWS program 35 is also referred to as EWS. The memory 14 also includes a data storage area 36. The data storage area 36 is an area for storing data necessary for executing the control program 34 and the like. The data storage area 36 includes a volatile area 36a and a nonvolatile area 36b (an example of a nonvolatile memory). The memory 14 is configured by combining a RAM, an NVRAM, a buffer provided in the CPU 12, and the like. The memory 14 may further be combined with a HDD, a portable storage medium such as a USB memory detachable from the MFP 10, and the like. For example, the volatile area 36a is provided in the RAM, and the nonvolatile area 36b is provided in the NVRAM. Also, the volatile area 36a and the nonvolatile area 36b do not have to be provided in physically separate memories, but may be provided in one memory 14. Also, the memory 14 may be a single unit such as a RAM or a flash memory. In this case, the memory 14 may be configured to include only one of the volatile area 36a or the nonvolatile area 36b.

[0012] Furthermore, the memory 14 may be an example of a computer-readable storage medium. A computer-readable storage medium is a non-transitory medium. In addition to the above examples, non-transitory media also include recording media such as CD-ROMs and DVD-ROMs. A non-transitory medium is also a tangible medium. On the other hand, an electrical signal carrying a program downloaded from a server on the Internet is a computer-readable signal medium, which is a type of computer-readable medium, but is not included in non-transitory computer-readable storage media.

[0013] The user I / F 15 has a display 16, an input I / F 18, and a wireless I / F 19. The display 16 is a liquid crystal display that displays various information of the MFP 10. The display 16 is not limited to a liquid crystal display, and may be a display of another display type such as an organic electroluminescence (EL) display. The input I / F 18 is, for example, a touch panel that is integrally configured with the display 16, and accepts user operations on icons, buttons, and the like displayed on the display 16. The input I / F 18 may be a hard key or the like other than a touch panel. The MFP 10 may also include a display alone and an input I / F alone as user interfaces. The wireless I / F 19 is an interface for reading an IC card by short-range wireless communication such as NFC (registered trademark).

[0014] The scanner 20 has a reading sensor such as a CCD or CIS, and generates image data corresponding to the reading of an original as scan data. The printer 22 executes a printing operation to print an image on a recording medium such as a sheet or a disk. The sheet is paper or an OHP. The recording method of the printer 22 may be an inkjet method, an electrophotographic method, or the like.

[0015] The modem 24 modulates the original data to be transmitted using the facsimile function into a transmittable signal and transmits it via the telephone line network 38, or receives a signal input from the telephone line network 38 and demodulates the original data.

[0016] The network I / F 28 is an I / F for performing communication using a network protocol such as TCP / IP, thereby enabling the MFP 10 to communicate with external devices such as a server 50 and a PC 60.

[0017] In this specification, the processing of the CPU 12 according to the instructions written in the program is basically indicated. That is, in the following description, the processing such as "judging", "selecting", "deciding", "obtaining", "receiving", and "controlling" represent the processing of the CPU 12. The processing by the CPU includes hardware control using the API of the OS. In this specification, the description of the OS is omitted and the operation of each program is explained. That is, in the following description, a description to the effect that "program B controls hardware C" may also mean that "program B controls hardware C using the API of the OS". In addition, the processing of the CPU 12 according to the instructions written in the program may be described in abbreviated terms. For example, it may be described as "performed by the CPU 12". In addition, the processing of the CPU 12 according to the instructions written in the program may be described in abbreviated terms such as "performed by program A".

[0018] In addition, in this specification, "obtain" is used as a concept that does not necessarily require a request. In other words, the process of the CPU 12 receiving data without making a request is also included in the concept of "the CPU obtains data." In addition, in this specification, "data" is represented as a bit string that can be read by a computer. Data with the same substantial meaning but different formats are treated as the same data. The same applies to "information" in this specification. In addition, "request" and "instruct" are concepts that indicate outputting information indicating a request or information indicating an instruction to the other party. In addition, information indicating a request or information indicating an instruction is also simply referred to as "request" and "instruction."

[0019] Furthermore, the process by the CPU 12 to determine whether information A indicates event B may be conceptually described as "determining whether event B is present from information A." The process by the CPU 12 to determine whether information A indicates event B or event C may be conceptually described as "determining whether event B or event C is present from information A."

[0020] The MFP 10 can execute IFAX processing and ScanToEmail processing. The IFAX processing and ScanToEmail processing are processing for creating scan data by reading an image with the scanner 20, and sending the created scan data to an arbitrary email address (hereinafter, sometimes simply referred to as "email transmission"). The IFAX processing is processing for sending the created scan data by email in a manner conforming to an international standard. The ScanToEmail processing is processing for sending scan data by email in accordance with a standard defined by the manufacturer of the MFP 10, for example, without being bound by the IFAX standard. The MFP 10 of the first embodiment has an allowed domain list set, and in the IFAX processing and ScanToEmail processing, email transmission to email addresses other than email addresses including domains registered in the allowed domain list (hereinafter, sometimes simply referred to as "allowed domains" or "allowed domain list") and email addresses including subdomains is restricted. The domain is the character string following the at sign (@) of an email address. For convenience, an email address including a domain and an email address including a subdomain are also referred to as a "domain email address" and a "subdomain email address".

[0021] First, the setting of various parameters related to e-mail transmission, such as the permitted domain list, will be described. Incidentally, storing parameters in the memory 14 may also be referred to as setting. Incidentally, storing parameters in the memory 14 may also be referred to as registration. The registration of the permitted domain list in the MFP 10 may be executed, for example, in a web page provided by the EWS. The process of the control program 34 executed in the MFP 10 that receives a display request for a web page transmitted from the PC 60 will be described below with reference to the flowchart shown in FIG. 2. Incidentally, the PC 60 transmits the display request using a browser. Also, the MFP 10 may accept operations such as registration of the permitted domain list, which are possible by the EWS described below, via the touch panel of the input I / F 18, when the administrator is logged in to the MFP 10.

[0022] First, when a request to display a web page is made, the CPU 12 functioning as the EWS transmits web page data (an example of image data) showing an administrator login screen to the PC 60 (S100). The browser of the PC 60 that receives the web page data displays a screen shown by the web page data on the display of the PC 60. The user of the PC 60 can operate the screen displayed on the browser using the user I / F of the PC 60. Information showing the operation content on the browser is transmitted from the PC 60 to the MFP 10. The reception by the MFP 10 of information showing the operation content on the screen based on the web page data may be simply described as an operation being accepted via the screen or being input via the screen. It may also be described as an operation being accepted via the web page or being input via the web page. When the administrator login operation is accepted from the PC 60 via the administrator login screen and the administrator login is successful (S102: YES), the CPU 12 reads out parameters of the permitted domain list 43, the IFAX setting, and the ScanToEmail setting (see FIG. 4) from the non-volatile area 36b. The administrator login operation may be, for example, input of an administrator ID and password. Parameters may be referred to as setting values. The parameters of the permitted domain list 43, IFAX setting, and ScanToEmail setting may be simply referred to as the permitted domain list 43, IFAX setting, and ScanToEmail setting, respectively. The CPU 12 creates web page data showing the permission list setting screen 70 (see FIG. 3, an example of a setting screen) based on the read permitted domain list 43, IFAX setting, and ScanToEmail setting, and transmits it to the PC 60 (S104). The permission list setting screen 70 is then displayed on the PC 60. The web page displayed by the EWS is an example of a user I / F of the present application.

[0023] As shown in FIG. 3, the permission list setting screen 70 displays a combination of an allowed domain input field 72, a subdomain permission setting field 74, an allowed distinguishing domain input field 76, and a group input field 77 (an example of an input object) for each row. As shown in FIG. 3, when the input fields for each row are to be described separately, alphabets "a to e" are added after the reference numerals. The allowed domain input field 72 is a field for inputting an allowed domain that is a domain for which e-mail transmission is permitted. In FIG. 3, the allowed domain "brother.co.jp" is input in the allowed domain input field 72a, the allowed domain "brothergroup.net" is input in the allowed domain input field 72b, the allowed domain "brother.ne.jp" is input in the allowed domain input field 72c, the allowed domain "patentoffice.co.jp" is input in the allowed domain input field 72d, and the allowed domain "salesoffice.co.jp" is input in the allowed domain input field 72e. The number of allowed domains that can be registered is not limited to five, and may be one or other multiple numbers.

[0024] Furthermore, the subdomain permission setting field 74 is a field for setting whether or not to permit email sending to email addresses in the subdomain of the permitted domain entered in the permitted domain input field 72 in IFAX processing and ScanToEmail processing. When permitting email sending to email addresses in the subdomain, a check mark (R) is entered in the subdomain permission setting field 74. Furthermore, the permitted distinct domain input field 76 is a field for inputting the distinct domain of the permitted subdomain when email sending to email addresses in the subdomain is permitted without restriction.

[0025] The group input field 77 is a field for inputting a group that is permitted to send e-mail to the e-mail address of the permitted domain input in the permitted domain input field 72 and the sub-domain of the distinct domain input in the permitted distinct domain input field 76. In this embodiment, six groups, namely, "general affairs, sales G (abbreviation of group), sales G manager, development G, intellectual property G, and public", are set as groups that can be registered. In FIG. 3, the groups "development G, sales G" are input in the group input fields 77a and 77b, the group "development G" is input in the group input field 77c, the group "intellectual property G" is input in the group input field 77d, and the group "sales G, public" is input in the group input field 77e. In other words, one or more groups can be associated with the permitted domain and the sub-domain of the permitted domain. In addition, a selection field 78 for selecting at least one of IFAX processing and ScanToEmail processing is also displayed above the permitted domain input field 72 on the permission list setting screen 70.

[0026] The permission list setting screen 70 also includes a Done button (not shown). When the Done button is operated, the browser transmits the parameters input in each of the above-mentioned fields 72 to 78 to the MFP 10. The MFP 10 stores the received parameters in the memory 14 of FIG. 4. That is, when the administrator wants to register parameters, the administrator inputs the parameters to be registered in each of the fields 72 to 78 and presses the Done button. Then, when the setting on the permission list setting screen 70 is completed (S106: YES), the information set on the permission list setting screen 70 is stored in the non-volatile area 36b as the permitted domain list 43 and setting information as shown in FIG. 4 (S108). That is, the permitted domain list 43 is registered in the MFP 10. In this way, only the administrator of the MFP 10 can register the permitted domain list 43 in the MFP 10. Note that FIG. 4 shows an example of data stored in the non-volatile area 36b and its storage destination address. An address book 41 is stored in the memory areas 80a-l in Fig. 4. The address book 41 can be used when sending e-mail by registering it in advance as a destination e-mail address for scan data. In the address book 41 in Fig. 4, for example, e-mail address, name, kana (surname), and group information are set in order from the left in Fig. 4. The administrator or user of the MFP 10 can edit the address book 41 and change the information in the address book 41, for example, via the EWS or input I / F 18. Note that a telephone number for sending a fax may also be registered in the address book 41.

[0027] 4, the allowed domain list 43 is stored, and from the left in FIG. 4, information on the allowed domain entered in the allowed domain input field 72, information indicating whether there is an input in the subdomain permission setting field 74, information on the distinct domain entered in the allowed distinct domain input field 76, and information on the group entered in the group input field 77 are stored. That is, this information received on the allowed list setting screen 70 is stored as the allowed domain list 43. The information indicating whether there is an input in the subdomain permission setting field 74 is set to ON when a check mark is entered in the subdomain permission setting field 74, and is set to OFF when a check mark is not entered in the subdomain permission setting field 74.

[0028] Furthermore, on the web page provided by the EWS, the email subject and email body can be set when an email is sent in the IFAX process and the ScanToEmail process. When the email subject and email body are set on the web page, the email subject is stored in the memory area 80r and the email body is stored in the memory area 80s, as shown in FIG.

[0029] The IFAX setting in memory area 80t and the ScanToEmail setting in memory area 80u indicate whether or not there is an input in the selection field 78, and are set to ON when a check mark is entered in the selection field 78, and are set to OFF when a check mark is not entered in the selection field 78.

[0030] The MFP 10 also has a function of downloading an address book from a directory server. For example, the server 50 can store an address book 41a (see FIG. 1) in the same or similar data format as the address book 41. The address book 41a also has information on an email address, a name, a kana (surname), and a group, as shown in FIG. 4, set in it, like the address book 41. The server 50 functions as a directory server, and transmits the address book 41a in response to an access from the MFP 10. When the function of using the directory server is turned on, the MFP 10 performs authentication with the server 50 by communication conforming to the LDAP (abbreviation of Lightweight Directory Access Protocol) standard, for example, and downloads the address book 41a from the server 50, stores it in the volatile area 36a, and uses it. The storage area 80v in FIG. 4 stores setting information of a function of downloading the address book 41a from the server 50 using LDAP, and is set to ON when the setting is enabled, and is set to OFF when the setting is disabled.

[0031] Furthermore, the memory areas 80w-z store login authentication information 44 for logging in to the MFP 10, and store user names (registered users), login passwords, and groups in order from the left in FIG. 4. In FIG. 4, four users with user names "admin", "public", "userA", and "userB" are registered as an example. The login authentication information 44 can be edited by the EWS or input I / F 18. Each user can belong to one or more groups. Furthermore, each group can have multiple users belong to it.

[0032] In group setting, if the administrator sets the group set in the address book 41 in the permitted domain list 43 and the login authentication information 44 in the same way, the groups that can be set in each piece of information can be made the same. Then, when sending an email to an email address selected from the address book 41, the permitted domain associated with the group to which the user who sends the email belongs in the login authentication information 44 can be determined based on the group to which the user belongs in the permitted domain list 43, and the email sending restriction can be appropriately executed. That is, by making the settable groups the same, it is possible to appropriately execute the restriction on email sending according to the group to which the user belongs, which will be described later. Also, the MFP 10 may execute a process of making the groups of each piece of information the same (unifying). For example, when registering each piece of information of the address book 41, the permitted domain list 43, and the login authentication information 44, the MFP 10 executes a process of selecting a group to be set from the groups stored in the non-volatile area 36b. Also, the groups stored in the non-volatile area 36b may be added or deleted by the administrator. It is not necessary that the groups of the three pieces of information are completely the same. In addition, in this embodiment, six groups, namely, “General Affairs, Sales G, Sales G Manager, Development G, Intellectual Property G, and Public,” can be set in the address book 41, the permitted domain list 43, and the login authentication information 44.

[0033] Next, a login process in the MFP 10 will be described. When the MFP 10 is in a standby state, the control program 34 displays a home screen 100 shown in Fig. 5 on the display 16. The home screen 100 displays icons 102 corresponding to image processes that can be executed by the MFP 10. For example, the control program 34 displays, on the home screen 100, an icon 102a for executing a fax process, an icon 102b for executing a print process, and an icon 102c for executing a scan process.

[0034] Furthermore, a login button 103 for performing a login operation is displayed at the top of the home screen 100. The state shown in Fig. 5 indicates a logout state in which no user is logged in. In the logout state, the control program 34 displays the word "public" on the login button 103. In this logout state, functions according to the settings and authority of the "public" user in the login authentication information 44 can be executed.

[0035] The process of the control program 34 after displaying the home screen 100 will be described with reference to the flowchart shown in Fig. 6. First, the control program 34 judges whether or not the system is in a logged-in state where a user has logged in (S11). If the system is in a logged-out state (S11: NO), the control program 34 displays the word "public" on the login button 103 (S13), as shown in Fig. 5, and judges whether or not the login button 103 has been operated (S15).

[0036] The control program 34 displays a login reception screen (not shown) on the display 16 for inputting a user name and a password, and accepts the user name and password through the login reception screen (S17). If the combination of the user name and password accepted on the login reception screen matches any user's information in the login authentication information 44 (see FIG. 4), it determines that the login authentication has been successful (S19: YES), stores the successfully authenticated user name as the login user name in the non-volatile area 36b (S21), erases the login reception screen, displays the home screen 100, and executes S11. If the user is in the logged-in state, an affirmative determination is made in S11 (S11: YES), and the login user name stored in the non-volatile area 36b is displayed on the login button 103 (S23). If the authentication fails (S19: NO), the login reception screen is cleared and an error is displayed on the display 16, and since the user is not logged in (S11: NO), the home screen 100 is displayed again (S13) with the word "public" displayed on the login button 103. Also, the method of login authentication is not limited to a password, and may be an IC card or biometric authentication.

[0037] As described above, the MFP 10 switches users in response to a login operation. In the following description, the user operating the input I / F 18, that is, the "public" user when the MFP 10 is in a logged-out state and the logged-in user when the MFP 10 is in a logged-in state, will be collectively referred to as the "current user." Therefore, the "current user" changes depending on whether or not there is a login and the logged-in user.

[0038] Furthermore, if the result of S15 is negative (S15: NO), it is determined whether or not an IC card for login has been held over wireless I / F 19 (S25), and if short-range wireless communication between wireless I / F 19 and the IC card is successful (S25: YES), the user name is read from the IC card (S27), the read user name is stored in non-volatile area 36b as a login user name (S21), and MFP 10 is put into a logged-in state. Furthermore, if the IC card has not been held over (S25: NO), an operation on home screen 100 is accepted while remaining in the logged-out state, processing according to the operation is executed (S29), and S11 is executed.

[0039] Furthermore, when S23 is executed, it is determined whether or not the logout button has been operated (S31). For example, when the login button 103 displaying the login user name is operated in the login state, a confirmation screen (not shown) for confirming the execution of logout is displayed and the logout operation is accepted. When the logout operation is performed (S31: YES), the process associated with the logout is executed (S33), the information on the login user name stored in S21 is deleted from the non-volatile area 36b (S35), the state becomes logged out, and S11 is executed.

[0040] Furthermore, after entering the logged-in state, if the logout button is not operated (S31: NO) and a predetermined period of time has passed without any operation being performed on the home screen 100 (S37: YES), a logout process is executed (S33). Furthermore, if an operation is performed on the home screen 100 in the logged-in state, a process corresponding to the accepted operation is executed (S37: NO, S29).

[0041] Next, a process involving e-mail transmission in the MFP 10 will be described. When IFAX processing is performed, the icon 102a is operated. When the icon 102a is operated, an input screen 110 (see FIG. 9) for setting a destination e-mail address in the IFAX processing is displayed on the display 16, and the process shown in FIG. 7 and FIG. 8 is started.

[0042] First, an address input process is executed (S109). In the address input process, as shown in FIG. 10, it is determined whether the input is manual or from the address book 41 (S151). When the icon 110a (see FIG. 9) of the input screen 110 is operated (S151: MANUAL), an input screen 111a (see FIG. 9) for manually inputting a destination email address is displayed (S153). After displaying the input screen 111a, it is determined whether the input of the destination email address is complete (S155), and when the input is completed (S155: YES), the input email address is set as the destination email address (S157), and the set destination email address is displayed in the destination email address display field 110c of the input screen 110 (see FIG. 9), and the process of FIG. 10 is terminated.

[0043] On the other hand, when icon 110b (see FIG. 9) on input screen 110 is operated (S151: address book), it is determined whether the function of downloading address book 41a from the directory server is enabled (S159), and if "ON" is stored in memory area 80v (see FIG. 4) (S159: YES), address book 41a is obtained from server 50 and stored in volatile area 36a (S161) and S163 is executed; when "OFF" is stored in memory area 80v (S159: NO), address book 41a is obtained from non-volatile area 36b and stored in volatile area 36a (S165) and S163 is executed.

[0044] In S163, the control program 34 executes the address construction process for the current user shown in Fig. 11, and constructs an address book in the non-volatile area 36b according to the group to which the current user belongs from the address book 41a when S161 is executed in Fig. 10, or from the address book 41 when S165 is executed. Therefore, in the following description, the address book constructed for the current user will be referred to as the address book 41b. Also, in the following description, the case where S165 is executed (address book 41) will be described. Note that the address book 41a has the same or similar data format as the address book 41, so even when S161 is executed, the same processing as when S165 described below is executed can be performed.

[0045] As shown in FIG. 11, first, a storage area for storing address book 41b in volatile area 36a is initialized (S171), and variable n is set to 1 (S173). Variable n used in the process of FIG. 11 indicates which row from the top in address book 41 shown in FIG. 4. Next, data of AccessGroup (hereinafter, referred to as AG)(n) is acquired from address book 41 (S175), the acquired data of AG(n) is separated (S177), and variable m is set to 1 (S179). AG is, for example, information in the group column for each row (each destination email address) in address book 41 shown in FIG. 4. For example, "Mizuho" in AG(n=1) indicates two groups, "Development G, Sales G", set in the group column of the first row. Also, variable m is a variable that indicates, for example, what number group from the left in FIG. 4 it is when the group set in the group column indicated by AG(n) is separated. For example, in the case of "Mizuho" in AG(1), variable m=1 is the "Development G" which is the leftmost group in the group column, and variable m=2 is the "Sales G" which is the second from the left.

[0046] Next, a user list of the group indicated by AG(n)-(m) is obtained (S181). A user list is a list of registered users belonging to a group. For example, in the case of a group "Development G" of AG(1)-(1), a user (admin in this embodiment) who is set as the group to which he belongs, among the registered users registered in the login authentication information 44, is obtained as a user list. Similarly, in the case of a group "Sales G" of AG(1)-(2), for example, the user list is the users (admin and userA) who belong to "Sales G".

[0047] If the current user is included in the user list acquired in S181 (S182: YES), an address set (n) is set in address book 41b in volatile area 36a (S183), and S185 is executed. An address set is information for each line in address book 41 shown in FIG. 4, including "email address, name, kana (surname), and group."

[0048] Also, if the current user is not included in the user list (S182: NO), it is determined whether the variable m is greater than the maximum value of the post-separation list of AG(n) (S187). The maximum value of the post-separation list is the number of groups separated from AG(n), and in the case of AG(1), it is 2 (=the maximum value of the post-separation list) of "Development G, Sales G". If the variable m is less than the maximum value of the post-separation list (S187: NO), 1 is added to the variable m (S189), and the process from S181 is executed again. As a result, for each group separated from one AG(n), it is determined in order from the left in the group column of FIG. 4 whether the current user is included in the user list, and if so, the address set of that row is added to the address book 41b. Also, if the variable m is greater than the maximum value of the post-separation list (S187: YES), it is determined in S185 whether the variable n is greater than the maximum value of the address book list.

[0049] The address book list maximum value is the number of address sets (the number of registered destination email addresses) registered in the address book 41 in FIG. 10. If the variable n is equal to or less than the address book list maximum value (S185: NO), 1 is added to the variable n (S191), and S175 is executed for the incremented AG(n+1). As a result, for each row (address set) of the address book 41, the AG is separated in order from top to bottom in FIG. 4, and it is determined whether the current user is included in the user list, and if so, the address set is added to the address book 41b. Only address sets in which the group to which the current user belongs is set in the group column can be added to the address book 41b. If the variable n becomes greater than the address book list maximum value (S185: YES), the process shown in FIG. 11 ends.

[0050] Fig. 12 shows an address book 41b constructed when userA and userB are each logged in to the address book 41 shown in Fig. 4. As shown in the upper diagram of Fig. 12, when userA is logged in, of the address sets registered in the address book 41, address sets (five) in which at least one of the groups "Sales Manager, Sales G" to which userA belongs is included in the group column are set in the address book 41b. Also, as shown in the lower diagram of Fig. 12, when userB is logged in, of the address sets registered in the address book 41, address sets (three) including the group "Intellectual Property G" to which userB belongs are set in the address book 41b.

[0051] As shown in FIG. 10, when S163 is executed, a destination selection screen 111b (see FIG. 9) is displayed. In the destination selection screen 111b (an example of an input screen in the present application), only the email addresses included in the address book 41b created in S163 are displayed as selection candidates (S165). For example, the email addresses included in the address book 41b are displayed as selection candidates by a pull-down menu. That is, only the email addresses of the address set in which the group to which the current user belongs is set in the group field among the address sets included in the address book 41 are displayed as selection candidates for the destination email address. In the destination selection screen 111b, it is determined whether any email address has been selected among the selection candidates (S167), and when the selection is completed (S167: YES), the selected email address is set as the destination email address in the IFAX process (S157) and is displayed in the destination email address display field 110c (see FIG. 9).

[0052] As shown in Fig. 7, when S109 is executed, it is determined whether or not the start button 110d (see Fig. 9) on the input screen 110 has been operated (S110), and if the start button 110d has been operated (S110: YES), S112 is executed. With reference to the storage area 80t of the non-volatile area 36b, it is determined whether or not the IFAX target setting is ON (S112). If the IFAX target setting is ON (S112: YES), that is, if mail transmission in the IFAX process is restricted, an input address check process is executed (S114).

[0053] In the input address check process, as shown in Fig. 13, the destination email address input on the input screen 111a or selected on the destination selection screen 111b is obtained (S201). The destination email address obtained in S201 is referred to as the obtained address. The permitted domain list construction process for the current user is executed (S203).

[0054] In the address book construction process for the current user shown in Fig. 11, an address book 41b corresponding to the group to which the current user belongs is constructed, whereas in the permitted domain list construction process for the current user, a permitted domain list (see Fig. 12) corresponding to the group to which the current user belongs is constructed by the process shown in Fig. 14. Since the processes are similar, a description of the same process contents as in Fig. 11 will be omitted. In the following description, the permitted domain list constructed for the current user will be referred to as permitted domain list 43b.

[0055] As shown in Fig. 14, first, a storage area for storing permitted domain list 43b in volatile area 36a is initialized (S211), and variable n is set to 1 (S213). Variable n used in the processing of Fig. 14 indicates which line from the top of permitted domain list 43 shown in Fig. 4 it is. Moreover, the information on each line in permitted domain list 43 in Fig. 4, "permitted domain, sub-domain permitted setting, distinct domain, group", is referred to as a domain set.

[0056] Next, data of AG(n) is obtained from permitted domain list 43 (S215), the obtained data of AG(n) is separated (S217), and variable m is set to 1 (S219). Variable m is the same as in Fig. 11, and for example, in the case of the group "Development G, Sales G" of "brother.co.jp" in AG(1), variable m=1 is "Development G" and variable m=2 is "Sales G".

[0057] A user list of AG(n)-(m) is acquired (S221). If the acquired user list does not include the current user (S222: NO), the variable m is increased until it is greater than the post-separation list maximum value of AG(n), and S222 is judged for each user list (S227, S229). If the current user is included in the user list acquired in S221 (S222: YES), the domain set (n) is stored in the permitted domain list 43b in the volatile area 36a (S223). The variable n is compared with the permitted domain list maximum value, which is the number of domain sets (permitted domains) registered in the permitted domain list 43, and the variable n is increased until all domain sets are judged (S225, S231), and S215 and subsequent steps are repeatedly executed to judge each user list. The permitted domain list maximum value is the number of permitted domains registered in the permitted domain list 43, and is 5 in this embodiment as shown in FIG. 4. 4, and determines whether the current user is included in the user list. If so, the domain set is added to the allowed domain list 43b. Only domain sets that include the group to which the current user belongs can be added to the allowed domain list 43b.

[0058] As shown in the upper diagram of Fig. 12, when userA is logged in, among the domain sets registered in the permitted domain list 43, a domain set including at least one of the groups "Sales Manager, Sales G" to which userA belongs is set in the permitted domain list 43b. Also, as shown in the lower diagram of Fig. 12, when userB is logged in, among the domain sets registered in the permitted domain list 43, a domain set including the group "Intellectual Property G" to which userB belongs is set in the permitted domain list 43b.

[0059] As shown in FIG. 13, when S203 is executed, the permitted domain list checking process of S205 is executed. In the permitted domain list checking process, as shown in FIG. 15, the part following the @ mark in the acquired address acquired in S201 is acquired as the domain (S241). The domain acquired in S241 is referred to as the acquired domain. The variable n is set to 1 (S242). The variable n in the process of FIG. 15 indicates the line number from the top of the permitted domain list 43b (see FIG. 12). The following describes the case where userA is a logged-in user. In addition, in the following description, explanations of the same processing contents as those in FIG. 11 and FIG. 14 will be omitted.

[0060] It is determined whether the acquired domain is an exact match with the domain in the permitted domain list (n) (hereinafter, sometimes simply referred to as the permitted domain list (n)) (S244). For example, when the variable n=1, it is determined whether the acquired domain is an exact match with "brother.co.jp" in the permitted domain list (1) for userA (see FIG. 12). In this case, for example, if the acquired domain is "brother.co.jp", it is determined that the acquired domain is an exact match with the permitted domain list (n) (S244: YES), and the comparison is successful (S246).

[0061] On the other hand, for example, if the acquired domain is "ab.brother.co.jp", a subdomain of "brother.co.jp", it is determined that the acquired domain does not match the permitted domain list (1) completely (S244: NO). It is determined whether the subdomain permission setting list (1) for the permitted domain list (1) (the setting of the subdomain permission setting field 74 in the first line of the permitted domain list 43b) is ON (S248). In the case of user A, since the subdomain permission setting list (1) is OFF (S248: NO), if the acquired domain is "ab.brother.co.jp", a subdomain of "brother.co.jp", the match is not successful.

[0062] Next, in S250, 1 is added to the variable n, so that the variable n is set to 2, and it is determined whether the variable n is greater than the maximum allowed domain value of the allowed domain list 43b (S252). As shown in Fig. 12, the maximum allowed domain value for userA is 3. In this case, since the variable n is equal to or less than the maximum allowed domain value (S252: NO), S244 is executed again.

[0063] In the second S244, it is determined whether the acquired domain is an exact match with "brothergroup.net" in the permitted domain list (2) for user A. In this case, for example, if the acquired domain is "brothergroup.net", it is determined that the acquired domain is an exact match with the permitted domain list (2) (S244: YES), and the comparison is successful (S246).

[0064] On the other hand, for example, if the acquired domain is a subdomain "dp.brothergroup.net" of "brothergroup.net", it is determined that the acquired domain does not completely match the permitted domain list (2) (S244: NO), and it is determined whether the subdomain permitted setting list (2) is ON (S248). As shown in FIG. 12, since the subdomain permitted setting list (2) for userA is ON, it is determined positively (S248: YES), and the acquired domain is separated into an original domain and a differentiated domain (S255). A subdomain is set based on a main domain, and is a domain in which an arbitrary character string is added before the main domain. This main domain is described as an original domain, and the character string added before the original domain is described as a differentiated domain. For example, if the acquired domain is "dp.brothergroup.net", it is separated into an original domain "brothergroup.net" and a differentiated domain "dp". The method of separation is not particularly limited, but for example, if there is a character string that completely matches the permitted domain list (n) from the top domain side of the acquired domain, the completely matching part may be the unique domain, and the remaining part may be the distinguished domain. If a domain that completely matches the permitted domain list (n) is not included, a negative determination may be made in the next S257. Alternatively, information required for separating the unique domain, such as information on the top level domain, may be stored in advance in the data storage area 36, ​​or may be queried from the DNS, etc.

[0065] The unique domain separated from the acquired domain in S255 is described as the acquired unique domain, and the distinct domain separated from the acquired domain is described as the acquired distinct domain. The permitted domain list 43 determines whether the acquired unique domain separated in S255 is a perfect match with the permitted domain list (2) (S257). For example, if the acquired unique domain is "brothergroup.net", it matches "brothergroup.net" in the permitted domain list (2) (S257: YES), so a subdomain matching process is executed (S259). If the acquired unique domain does not match the permitted domain list (n), S250 is executed.

[0066] For example, if "brothergroup.net" is an original domain, then "ap.brothergroup.net", which is the original domain with the distinguished domain "ap" added to the beginning, becomes a subdomain of "brothergroup.net". In other words, a subdomain is a domain that is composed of a distinguished domain (e.g., "ap") and an original domain (e.g., "brothergroup.net"). In addition, in the example of the permitted domain list 43b in FIG. 12, the subdomain permission setting list (1) corresponding to "brother.co.jp" in the permitted domain list (1) is OFF, and the subdomain permission setting lists (2)(3) corresponding to "brothergroup.net" in the permitted domain list (2) and "salesoffice.co.jp" in the permitted domain list (3) are ON. In this case, sending of email to email addresses in the subdomain of "brother.co.jp" is restricted, and email to email addresses in the subdomain of "brothergroup.net" or the subdomain of "salesoffice.co.jp" is not restricted.

[0067] In the subdomain matching process, as shown in FIG. 16, it is determined whether or not the allowed distinct domain list (2) is set (the allowed distinct domain input field 76 in the second row of the allowed domain list 43b) (S271). For example, in FIG. 3, the distinct domains "ap" and "dp" are input in the allowed distinct domain input field 76b corresponding to the allowed domain "brothergroup.net". As shown in FIG. 12, since "ap" and "dp" are set in the allowed distinct domain list (2), it is determined that the allowed distinct domain list (2) is set (S271: YES). Next, it is determined whether or not there is a domain in the allowed distinct domain list (2) that completely matches the acquired distinct domain (S273). Here, "ap" and "dp" are set in the allowed distinct domain list (2), and if the acquired distinct domain is "dp", it is determined that there is a domain in the allowed distinct domain list (2) that completely matches the acquired distinct domain (S273: YES), and the subdomain matching is successful (S275). That is, the subdomain "dp.brothergroup.net" of "brothergroup.net" containing "dp" is successfully matched. Also, since "ap" is also set in the permitted distinct domain list (2), the subdomain "ap.brothergroup.net" containing "ap" is also successfully matched. On the other hand, if the acquired distinct domain is other than "ap" and "dp", it is determined that there is no domain in the permitted distinct domain list (2) that exactly matches the acquired distinct domain (S273: NO), and the subdomain matching is deemed to be unsuccessful (S277). That is, only the subdomains "dp.brothergroup.net" and "ap.brothergroup.net" are successfully matched, and the other subdomains are unsuccessful. Then, when the processing of S275 or S277 is completed, the subdomain matching process ends.

[0068] When the subdomain matching process is completed, as shown in Fig. 15, it is determined whether or not the subdomain matching is successful (S261). If the subdomain matching is successful (S261: YES), the matching is deemed successful (S246). On the other hand, if the subdomain matching is unsuccessful (S261: NO), 1 is added to the variable n in S250. At this time, the variable n is set to 3, and since the variable n (= 3) is equal to or less than the maximum value (= 3) of the allowed domain list (S252: NO), the process returns to S244.

[0069] In S244, it is determined whether the acquired domain is an exact match with "salesoffice.co.jp" in the permitted domain list (3). In this case, for example, if the acquired domain is "salesoffice.co.jp", it is determined that the acquired domain is an exact match with the permitted domain list (3) (S244: YES), and the comparison is successful (S246).

[0070] On the other hand, for example, if the acquired domain is a subdomain "kp.salesoffice.co.jp" of "salesoffice.co.jp", it is determined that the acquired domain does not completely match the permitted domain list (3) (S244: NO). Here, as shown in FIG. 12, since the subdomain permission setting list (3) is ON, it is determined whether the acquired unique domain completely matches the permitted domain list (3) (S255). If the acquired unique domain is "salesoffice.co.jp", it completely matches the permitted domain list (3) (S257: YES), so the subdomain collation process is executed (S259).

[0071] In the subdomain matching process, as shown in FIG. 16, it is determined whether or not the distinguishing domain list (3) is set (S271). In FIG. 3, no distinguishing domain is input in the permitted distinguishing domain input field 76e corresponding to the permitted domain "salesoffice.co.jp". Therefore, it is determined that the permitted distinguishing domain list (3) is not set (S271: NO), and S275 is executed. Therefore, in this embodiment, when the subdomain permission setting field 74 is set to ON and no distinguishing domain is input in the permitted distinguishing domain input field 76, all subdomains of the permitted domain corresponding to the permitted distinguishing domain input field 76 are permitted without restriction. In other words, sending of e-mail to e-mail addresses of all subdomains of the permitted domain "salesoffice.co.jp" is permitted without restriction. In other words, even if the distinguishing domain is not limited to "kp", but is, for example, "ap", "dp", or any other character string, the subdomain of "salesoffice.co.jp" is successful in the subdomain matching. When the sub-domain permission setting field 74 is set to ON and no distinct domain is input in the permitted distinct domain input field 76, it may be determined that matching has failed for all acquired distinct domains.

[0072] 15, if the subdomain matching is successful (S261: YES), the matching is successful (S246), and if the subdomain matching is unsuccessful (S261: NO), 1 is added to the variable n in S250. In this case, since the variable n (= 4) is greater than the maximum value (= 3) of the permitted domain list (S252: YES), the matching is unsuccessful (S263). Then, the permitted domain list matching process ends.

[0073] When the permitted domain list comparison process is completed, it is determined whether or not the comparison is successful (S207) as shown in Fig. 13. If the comparison is successful (S207: YES), information indicating that there is no domain restriction error is stored in memory 14 (S208), and if the comparison is unsuccessful (S207: NO), information indicating that there is a domain restriction error is stored in memory 14 (S209), and the process in Fig. 13 is terminated. Incidentally, storing information indicating an error in memory 14 may be referred to as generating an error.

[0074] When the input address check process is completed, as shown in Fig. 7, it is determined in S120 whether or not a domain restriction error has occurred (S120). If a domain restriction error has occurred (S120: YES), an error screen is displayed on the display 16 (S122), and the setting of the email address set on the input screen 110, that is, the setting of the email address to which the scan data is to be sent in the IFAX process, is deleted (S124). Then, the process returns to S109.

[0075] Furthermore, if no domain restriction error has occurred in S120 (S120: NO), the email subject and email body (see FIG. 4) are obtained from the non-volatile area 36b (S126). Next, as shown in FIG. 8, a scan process is executed (S128) and the created scan data is obtained (S130). Then, email transmission data with a job type of IFAX is created (S132). This email transmission data includes the job type (IFAX), the acquisition address, the email subject, the email body, and the scan data. Then, when the email transmission data is created, the email transmission process is executed (S134).

[0076] In the mail transmission process, as shown in Fig. 17, it is determined whether the job type included in the mail transmission data is IFAX (S281). The selection field 78 in Fig. 3 is for selecting a process that permits mail transmission to an authorized domain registered in the authorized domain list. In other words, the selection field 78 is for selecting a process that restricts mail transmission to a domain not registered in the authorized domain list. Therefore, by checking the selection field 78a for selecting the IFAX process, mail transmission to an email address in a domain not registered in the authorized domain list is restricted during IFAX processing.

[0077] Also, by inputting a check mark in the selection field 78b for selecting ScanToEmail processing, during ScanToEmail processing, sending of e-mail to an e-mail address of a domain not registered in the permitted domain list is restricted. Here, since the job type included in the e-mail sending data created earlier is IFAX, the job type is determined to be IFAX (S281: YES), and it is determined whether or not the IFAX target setting is ON (S283). As shown in FIG. 4, since the IFAX target setting is ON, it is determined that the IFAX target setting is ON (S283: YES). Then, the permitted domain list comparison process is executed (S285, FIG. 15). This process has been explained above, so its explanation is omitted. When the permitted domain list comparison process is completed, it is determined whether or not the comparison is successful (S287). Then, if the comparison is unsuccessful (S287: NO), it is determined that a domain restriction error has occurred (S289), and the e-mail sending process is completed. On the other hand, if the comparison is successful (S287: YES), the e-mail sending data is sent to the acquired address (S291), and the e-mail sending process is completed.

[0078] When the mail transmission process is completed, as shown in FIG. 8, it is determined whether or not a domain restriction error has occurred as a result of S134 (S136). If a domain restriction error has occurred (S136: YES), an error screen is displayed on the display 16 (S138), and this flow ends. On the other hand, if a domain restriction error has not occurred (S136: NO), it is determined whether or not the transmission of the mail transmission data transmitted in S291 has been completed normally (S140). If the transmission of the mail transmission data has been completed normally (S140: YES), a transmission completion screen is displayed on the display 16 (S142), and this flow ends. Also, if the transmission of the mail transmission data has not been completed normally (S140: NO), a transmission failure screen is displayed on the display 16 (S144). Then, the mail transmission data is stored in the non-volatile area 36b as a retry job (S146), and this flow ends.

[0079] If the IFAX target setting is OFF in S112 of FIG. 7 (S112: NO), the process proceeds to S126 and the input address check process of S114 is skipped. Therefore, the permitted domain list comparison process (S205) of S205 of FIG. 13 is skipped. Also, if the IFAX target setting is OFF in S283 of FIG. 17 (S283: NO), it is determined whether the job type is ScanToEmail (S293). If the job type is IFAX, it is determined that the job type is not ScanToEmail (S293: NO), and the process proceeds to S291. That is, even if the IFAX target setting is OFF in S283 (S283: NO), the permitted domain list comparison process of S285 is skipped. Therefore, if the IFAX process is performed with the IFAX target setting OFF, the IFAX process is performed without performing the process of comparing the acquired address with the permitted domain list 43b. In other words, the transmission of scan data in IFAX processing is carried out without any restriction to any email address.

[0080] Next, the ScanToEmail process will be described. The ScanToEmail process by the control program 34 is almost the same as the IFAX process described above, so only the differences will be described. When the ScanToEmail process is executed, the icon 102c is operated on the home screen 100 shown in FIG. 5. This causes an input screen (not shown) for inputting a destination email address in the ScanToEmail process to be displayed on the display 16. The permitted domain list 43 starts the process of FIGS. 7 and 8, and an email address is set manually or by the address book 41b, as in the input screen in the IFAX process. When the address book 41b is used, the selection candidates of the email address to be displayed on the destination selection screen 111b are restricted according to the group of the current user, as in the IFAX process.

[0081] In the ScanToEmail process, in S112, it is determined whether the ScanToEmail target setting is ON. In addition, in S132, data for sending e-mail with a job type of ScanToEmail is created. In addition, in S281 of the e-mail sending process, it is determined that the job type is not IFAX (S281: NO), and in S293, it is determined that the job type is ScanToEmail (S293: YES). Then, in S295, if the ScanToEmail target setting is ON (S295: YES), the process proceeds to S285. Note that the processes other than these processes are the same as the IFAX process by the control program 34 described above. As a result, in the ScanToEmail process, as in the IFAX process, it is possible to perform a comparison with the permitted domain list according to the group to which the current user belongs, and to restrict the sending of scan data.

[0082] In addition, the retry job stored in the non-volatile area 36b in S146, i.e., the mail transmission data stored in the non-volatile area 36b after the mail transmission has failed, is retransmitted by the processing of the control program 34. In more detail, as shown in FIG. 18, it is determined whether a predetermined time has elapsed since the retry job was stored in the non-volatile area 36b (S301). If the predetermined time has elapsed (S301: YES), the mail transmission data stored in the non-volatile area 36b as the retry job is obtained (S303). Then, the mail transmission process is executed (S305). The mail transmission process here is the same as the mail transmission process described above (see FIG. 17), and therefore will not be described.

[0083] Then, it is determined whether or not a domain restriction error has occurred in the mail transmission process (S307). At this time, if a domain restriction error has occurred (S307: YES), an error screen is displayed on the display 16 (S309), and this flow ends. On the other hand, if a domain restriction error has not occurred (S307: NO), it is determined whether or not the transmission of the mail transmission data in the mail transmission process has been completed normally (S311). Then, if the transmission of the mail transmission data has been completed normally (S311: YES), a transmission completion screen is displayed on the display 16 (S313), and the retry job is deleted from the non-volatile area 36b (S315). This ends the flow. On the other hand, if the transmission of the mail transmission data has not been completed normally (S311: NO), a transmission failure screen is displayed on the display 16 (S317), and this flow ends. In this way, even when a retry job in the IFAX process or the ScanToEmail process is retransmitted, the transmission restriction of the scan data is executed according to the group to which the current user belongs and the permitted domain list.

[0084] According to the above-described first embodiment, the following effects are achieved.

[0085] As described above, an allowed domain list 43b of allowed domains associated with groups to which the logged-in user belongs is constructed (see FIG. 12). For example, if userA is the logged-in user, the sending of scanned data by email is restricted for groups to which userA does not belong (Development G, Intellectual Property G, Public) to destination email addresses in the allowed domains "brother.ne.jp" and "patentoffice.co.jp" associated in the allowed domain list 43. In addition, the sending of scanned data by email is not restricted for groups to which userA belongs (Sales G Manager, Sales G) to destination email addresses in the allowed domains "brother.co.jp", "brothergroup.net", and "salesoffice.co.jp" associated in the allowed domain list 43.

[0086] According to this, the destination email address of the scan data can be managed by the group to which the logged-in user belongs. If the acquired domain obtained from the destination email address is an authorized domain associated with the group to which the logged-in user belongs, the transmission is permitted, and if not, the transmission can be restricted. This allows permission and restriction of transmission of the email transmission function to be executed according to the group to which the logged-in user belongs. Even if the address book 41 registered for each device is different, the destination restriction can be managed in an integrated manner according to the group to which the user belongs. For example, if the department to which the user belongs and the place of work are fixed, the MFP 10 to be used is limited, and by changing the MFP 10, the destination restriction can be appropriately performed. However, the MFP 10 used by the user may be changed due to a change in department due to personnel transfer or a free work environment due to a free address office. Therefore, by managing the destination according to the group to which the user belongs, it is possible to achieve both ease of use of the scan email function and improved security.

[0087] Moreover, as information to be stored in the non-volatile area 36b, a plurality of groups can be stored in association with one authorized domain (see FIG. 4). If the acquired domain matches an authorized domain associated with any of the groups to which the logged-in user belongs, transmission is permitted. If multiple authorized domains are to be stored in association with one group, then for the authorized domains associated with the multiple groups, it is necessary to store the character strings of the authorized domains in association with each of the multiple groups. Therefore, if the number of authorized domains associated with one group increases, the storage capacity required to be secured in the memory 14 increases. On the other hand, by storing multiple groups in association with one authorized domain, the number of authorized domains stored in the non-volatile area 36b can be reduced, and the storage capacity can be reduced.

[0088] Also, in response to an operation on the EWS web page, the allow list setting screen 70 is displayed, a group is accepted in a group input field 77, and the accepted group is associated with a corresponding allowed address and stored in the allowed domain list 43. In this way, by operating the allow list setting screen 70 via the EWS, it is possible to set a group for an allowed domain included in the allowed domain list 43 or change the set group.

[0089] Furthermore, in response to an operation on a web page of the EWS, an allowed domain is read from the allowed domain list 43 in the non-volatile area 36b and displayed on the allowed list setting screen 70. Then, a group entered in the group input field 77 is associated with the allowed domain corresponding to that group input field 77 and stored in the allowed domain list 43 for updating. By storing the allowed domain list 43 in the non-volatile area 36b, the previous allowed domain list 43 can be continuously used even after the power of the MFP 10 is turned ON / OFF. Then, the group information in the allowed domain list 43 in the non-volatile area 36b can be updated on the allowed list setting screen 70.

[0090] Also, input of a destination email address is accepted on input screen 110, and email transmission is restricted for destination email addresses in authorized domains that are not supported by the group to which the logged-in user belongs and by authorized domain list 43b, but is not restricted for destination email addresses in the supported authorized domain list. This makes it possible to determine the acquisition domain of the destination email address entered on input screen 110 based on the authorized domain or group in authorized domain list 43b, and to determine whether or not to restrict email transmission.

[0091] Also, selection candidates for selecting a destination email address are displayed on the destination selection screen 111b (see FIG. 9). Of the candidates registered in the address book 41, only candidates corresponding to a group to which the logged-in user belongs are displayed as selection candidates on the destination selection screen 111b. This eliminates the need to check destination email addresses to which the logged-in user can send email by limiting the display to those to which the logged-in user can send email, thereby reducing the occurrence of sending mistakes and sending errors.

[0092] Furthermore, whether the acquired domain matches the permitted domain is determined not only when the destination email address is set on the input screen 110 (S205) but also after the data for sending email is created (S285). This makes it possible to restrict the sending of scan data by reflecting the settings of the authorized domain list 43 after the destination email address is acquired and before the data for sending email is created.

[0093] Furthermore, whether the acquired domain matches the permitted domain is determined not only when the destination email address is set on the input screen 110 (S205) but also when email transmission fails and is resent (S305). This makes it possible to restrict the transmission of scan data by reflecting the settings of the permitted domain list 43 after the email transmission fails and the resend is executed, if the permitted domain list 43 is changed.

[0094] Furthermore, if the acquired domain does not match the permitted domain, and if the acquired domain matches a subdomain included in the permitted domain list 43 and the subdomain of the permitted domain corresponding to the group to which the logged-in user belongs in the permitted domain list 43 and the acquired domain match, then email transmission is permitted. According to this, even if the acquired domain does not match the permitted domain, email transmission is not restricted as long as the subdomain of the permitted domain corresponding to the group of the logged-in user matches the acquired domain. This allows any subdomain of an authorized domain included in the permitted domain list 43 to be set as a domain permitted for sending scanned data.

[0095] Second embodiment Next, a second embodiment of the present application will be described. In the above-described first embodiment, the permitted domain list 43 is used to determine whether or not to restrict email transmission. In contrast, in the second embodiment, in addition to the permitted domain list 43, the permitted address list is used to determine whether or not to restrict email transmission. The second embodiment is basically the same as the first embodiment, except for using the permitted address list. Therefore, the description of the same contents as the first embodiment will be omitted as appropriate.

[0096] As shown in Fig. 19, the permission list setting screen 170 (an example of a setting screen) of the second embodiment displays, in addition to the display items of the first embodiment, a combination of a permission address input field 82 and a group input field 83 on each line. The permission address input field 82 is a field for inputting an email address (hereinafter, referred to as a permission address) that is permitted to send email. In Fig. 19, the permission address "taro.horita@brother.co.jp" is input in the permission address input field 82a, and the permission address "hanako.aichi@brother.co.jp" is input in the permission address input field 82b. Note that there is no limit to the number of permission addresses that can be registered.

[0097] The group input field 83 is a field for inputting a group that is permitted to send an email to the permitted address input in the permitted address input field 82. In FIG. 19, the group "Development G, Sales G" is input in the group input field 83a, and the group "Sales G Manager" is input in the group input field 83b. One or more groups can be associated with the permitted address. As in the first embodiment, the CPU 12 receives the permitted address in the permitted address input field 82 and the group in the group input field 83 through the web page of the EWS, and stores the information set in the permitted list setting screen 170 in the non-volatile area 36b as the permitted address list 85, as shown in FIG. 20. The permitted address list 85 is stored, for example, in the storage areas 86a and 86b behind the storage areas 80a to 80q of the permitted domain list 43.

[0098] Fig. 21 shows the permitted domain list checking process of the second embodiment. The control program 34 of the second embodiment executes the processes from Fig. 6 onwards in the same manner as in the first embodiment, and starts the process of Fig. 21 in the permitted domain list checking process of S205 of the input address check process of Fig. 13. As shown in Fig. 21, first, the control program 34 executes a permitted address list construction process for the current user (S401). In this permitted address list construction process for the current user, a permitted address list 85b corresponding to a group to which the current user belongs is constructed in the volatile area 36a, similar to the address book construction process for the current user (see Fig. 11) and the permitted domain list construction process for the current user (see Fig. 14) of the first embodiment.

[0099] Specifically, referring to FIG. 14, after initializing the storage area in volatile area 36a for constructing permitted address list 85b (S211), the information in the group column of each row in permitted address list 85 shown in FIG. 20 is separated as AG(n) using variable n (S217), and the groups in each group column are acquired sequentially from the left by AG(n)-(m) using variables n and m (S221). Then, it is determined whether the current user (public or logged-in user) is included in the user list of the group indicated by the acquired AG(n)-(m) (S222). If the current user is included in the user list, the mail set (information in each row of permitted address list 85) (n) is set in permitted address list 85b (S222: YES, S223), and if not, it is not set in permitted address list 85b (S222: NO), and the next AG(n)-(m) is determined (S227). In this way, permitted address list 85b according to the group to which the current user belongs is constructed.

[0100] FIG. 22 shows the permitted address list 85b when userA and userB are logged in to the permitted address list 85 shown in FIG. 20. As shown in the upper diagram of FIG. 22, when userA is logged in, among the mail sets registered in the permitted address list 85, a mail set including at least one of the groups "Sales Manager, Sales G" to which userA belongs is set in the permitted address list 85b. Also, as shown in the lower diagram of FIG. 12, when userB is logged in, among the mail sets registered in the permitted address list 85, a mail set including the group "Intellectual Property G" to which userB belongs is set in the permitted address list 85b. In the example shown in FIG. 12, since there is no corresponding mail set in the case of userB, there is no mail set registered as the permitted address list 85b. In this way, a mail set in which at least one of the groups to which the current user belongs is set in the group column of the permitted address list 85 can be constructed as the permitted address list 85b in the non-volatile area 36b.

[0101] 21, when S401 is executed, 1 is set to the variable n (S403), and it is determined whether or not the address acquired in S201 of Fig. 13 exactly matches the permitted address in the n-th permitted address list (n) of the permitted address list 85b constructed in S401 (S405). If they match (S405: YES), it is determined that the match was successful (S407), the processing of Fig. 21 is terminated, and S207 of Fig. 13 is executed.

[0102] On the other hand, if they do not match (S405: NO), 1 is added to the variable n (S409), and it is determined whether the variable n is greater than the maximum value of the permitted address list (S411). The maximum value of the permitted address list here refers to the number of mail sets in the permitted address list 85b (the number of registered permitted addresses). If the variable n is equal to or less than the maximum value of the permitted address list (S411: NO), S405 is executed.

[0103] Then, when the variable n becomes larger than the maximum value of the allowed address list (S411: YES), in S413, the allowed domain list matching process (S241) of FIG. 15 in the first embodiment is started, and when the process ends, the process of FIG. 21 ends and S207 of FIG. 13 is executed. As a result, if matching using the allowed address list 85b is not successful, matching using the allowed domain list 43b is performed. In this way, in the second embodiment, in addition to the allowed domain list 43, the allowed address list 85 is used to determine whether or not to restrict email sending.

[0104] In the above description, the process of Fig. 21 is started in S205 of the input address check process of Fig. 13, but the permitted domain list comparison process of Fig. 21 may also be executed in S285 of the mail sending process of Fig. 17. That is, when sending mail after creating the scan data (S134) shown in Fig. 8 or when resending mail (S305) shown in Fig. 18, comparison using the permitted address list 85 may be executed, and if comparison using the permitted address list 85b is unsuccessful, comparison using the permitted domain list 43b may be executed. In this case, after the process of Fig. 21 is completed, S287 of Fig. 17 is executed.

[0105] According to the above-described second embodiment, the same effects as those of the first embodiment are achieved. Moreover, the second embodiment achieves the following effects.

[0106] As described above, in the second embodiment, the permitted address list 85, which is a list of email addresses that are permitted to send email, can be set. The permitted address list 85 can be set to associate multiple groups with one permitted address. The control program 34 transmits email when the acquired address (destination email address) is an authorized address included in the permitted address list 85b, and restricts email transmission when it is not included. In addition, when the acquired address is an authorized address included in the permitted address list 85b but does not correspond to the group of the logged-in user (S405: YES), it determines whether the acquired domain matches the authorized domain (S413) as in the first embodiment. According to this, even if the destination email address is an authorized address included in the permitted address list 85b but does not correspond to the group to which the logged-in user belongs, the authorized domain list 43b can permit email transmission. That is, when the acquired domain matches the authorized domain and the acquired domain is an authorized domain that corresponds to the group to which the logged-in user belongs in the authorized domain list 43b, email transmission can be permitted.

[0107] Incidentally, each of the above-described embodiments is merely an example of the present invention, and it goes without saying that each of the embodiments of the present invention can be modified as appropriate without departing from the gist of the present invention. For example, the execution order of each process described above can be changed as appropriate without changing the gist of the present invention. In other words, it is possible to implement the present invention in various aspects with various changes and improvements based on the knowledge of a person skilled in the art. Specifically, for example, in the above-mentioned second embodiment, the comparison is performed using both the permitted domain list 43 and the permitted address list 85, but the comparison may be performed using only the permitted address list 85. For example, if the control program 34 judges in S411 to be positive (S411: YES), the control program 34 may not execute S413, but may determine that the comparison is unsuccessful and end the process of FIG. 21. This allows the comparison to be performed using only the permitted address list 85b when the acquired address is acquired (S205), after the scan data is created (S285), or when the mail is resent (S305). Also, the comparison may be performed in combination, such as by executing both comparisons in at least one of S205, S285, and S305, and by executing one of the comparisons in the remaining steps. In the second embodiment described above, a check is first performed using the permitted address list 85b, and if the check is unsuccessful using the permitted address list 85b, a check is performed using the permitted domain list 43b. However, a check may be first performed using the permitted domain list 43b, and if the check is unsuccessful, a check is performed using the permitted address list 85b. In addition, in each of the above embodiments, the permitted domain list comparison process is executed at three timings: when the address is acquired (S205), after the scan data is created (S285), and when the email is resent (S305), but it may be executed at at least one timing. Furthermore, when performing matching of both the allowed domain list 43 and the allowed address list 85 as in the second embodiment, matching without considering groups may be performed in either the allowed domain list 43 or the allowed address list 85. In other words, matching may be performed in the allowed domain list 43 or the allowed address list 85 without constructing the allowed domain list 43b or the allowed address list 85b according to the group to which the current user belongs. Furthermore, in each embodiment, restrictions on email transmission are implemented based on permitted domains and subdomains, but restrictions may be implemented only based on permitted domains.

[0108] In the first embodiment, the permitted domain input field 72, the subdomain permission setting field 74, and the permitted distinct domain input field 76 are displayed on the permission list setting screen 70, but the permitted domain input field 72 and the subdomain permission setting field 74 may be displayed without displaying the permitted distinct domain input field 76. In this case, all subdomains of the permitted domain checked in the subdomain permission setting field 74 are set as subdomains to which scan data can be sent. In addition, the permitted list setting screen 70 may not display the subdomain permission setting field 74, but instead display the permitted domain input field 72 and the permitted distinct domain input field 76. In such a case, subdomains including the distinct domain entered in the permitted distinct domain input field 76 are set as subdomains to which scan data can be sent. Furthermore, the data storage destinations (volatile area 36a, non-volatile area 36b) in the above embodiments are merely examples. For example, the permitted domain list 43b may be stored in the non-volatile area 36b. Also, a configuration may be possible in which only one group can be associated with one authorized domain. In each embodiment, the registration of a domain or email address is accepted by both the EWS and the user I / F 15, but registration may be accepted by only one of them. In the above embodiments, the processes shown in Figures 2, 6 to 8, 10, 11, 13 to 18, and 21 are executed by the CPU 12. However, these processes may be executed by ASIC or other logic integrated circuits, or may be executed by cooperation between the CPU, ASIC, and other logic integrated circuits. These devices that process in place of the CPU 12 or devices that process in cooperation with the CPU 12 are examples of the controller of the present application. A combination of the CPU 12 and a part of the memory 14, such as a buffer, may also be an example of a controller. [Explanation of symbols]

[0109] 10: MFP, 12: CPU, 15 user I / F, 20: scanner, 28: network I / F, 36b non-volatile area, 41, 41a, 41b address book, 43, 43b permitted domain list, 70, 170 permitted list setting screen, 77 group input field, 85, 85b permitted address list, 110 input screen, 111b destination selection screen.

Claims

1. An image forming apparatus including a communication interface, a controller, and a scanner, The controller: When sending scan data formed by the scanner by email, the image forming apparatus is configured to transmit the scan data via the communication interface by email when an acquired domain matches an authorized domain, and to restrict the email transmission of the scan data when the acquired domain does not match an authorized domain, the acquired domain being a domain included in a destination email address of the email transmission, and the authorized domain being a domain included in an authorized domain list that is registered in advance in the image forming apparatus; The image forming apparatus includes: Multiple groups can be registered, to which multiple users who can log in can belong. The permitted domain list includes: The permitted domains included in the permitted domain list can be set to correspond to any one of the groups; The controller: When sending the scanned data by email, an image forming device configured to restrict the email transmission of the scan data if the acquired domain matches the authorized domain but the authorized domain does not correspond to the group to which the login user belongs in the authorized domain list, and not restrict the email transmission of the scan data if the acquired domain matches the acquired domain and the authorized domain that corresponds to the group to which the login user belongs in the authorized domain list, and the login user is a user logged in to the image forming device.

2. Further comprising a non-volatile memory, The permitted domain list includes: information on a plurality of the authorized domains is stored in the non-volatile memory, and a setting can be made so that a plurality of the groups correspond to one of the authorized domains stored in the non-volatile memory, and a first group and a second group can be set as the groups; The controller: When sending the scanned data by email, 2. The image forming device of claim 1, wherein if the acquired domain is the authorized domain stored in the non-volatile memory and matches the authorized domain associated with both the first group and the second group, the image forming device is configured not to restrict the email sending of the scan data in either case where the group to which the logged-in user belongs is the first group or where the group to which the logged-in user belongs is the second group.

3. A user interface is further provided, The controller: a setting screen is displayed on the user interface in response to an operation via the user interface, the setting screen including a plurality of allowed domains included in the allowed domain list and a plurality of input objects corresponding to each of the plurality of allowed domains and for inputting the group; The controller:

3. The image forming apparatus according to claim 1, further comprising: a group input unit configured to: update the allowed domain list when the group input unit receives input of the group via the input object, so as to associate the input group with the allowed domain corresponding to the input object.

4. Further comprising a non-volatile memory, The permitted domain list includes: A plurality of the authorized domains are stored in a non-volatile memory; The controller: reading out the plurality of permitted domains stored in the non-volatile memory in response to an operation via the user interface, and displaying the setting screen; 4. The image forming apparatus according to claim 3, further comprising: an input object for inputting a group to a non-volatile memory, the non-volatile memory being configured to correspond to the input object and to store the input group in the non-volatile memory, the non-volatile memory being configured to update the allowed domain list when the input object is received via the input object.

5. A user interface is further provided, The controller: an input screen is displayed on the user interface in response to an operation via the user interface, the input screen being a screen for inputting the destination email address; The controller: If the acquired domain of the destination email address input on the input screen matches the permitted domain, but the permitted domain does not correspond to the group to which the login user belongs in the permitted domain list, the acquired domain matches the permitted domain, and the input destination email address is restricted from being used for email transmission; 3. An image forming apparatus as described in claim 1 or claim 2, configured so that if the acquired domain of the destination email address entered on the input screen matches the permitted domain, and if the acquired domain matches the permitted domain corresponding to the group to which the login user belongs in the permitted domain list, then no restriction is placed on using the entered destination email address for sending email.

6. The electronic mail server further includes an address book in which candidates for the destination email address are registered, The input screen is a selection candidate for selecting the destination email address is displayed, and the destination email address can be input based on the selected selection candidate; The controller: among the candidates registered in the address book, a candidate corresponding to the group to which the login user belongs is set as the selection candidate on the input screen, and a candidate not corresponding to the group to which the login user belongs is not set as the selection candidate on the input screen, The group that can be associated with candidates registered in the address book; The image forming apparatus according to claim 5 , wherein the group that can be associated with the permitted domain included in the permitted domain list is the same as the group that can be associated with the permitted domain included in the permitted domain list.

7. The controller: When the destination email address input on the input screen is acquired, it is determined whether the acquired domain matches the permitted domain, and if the acquired domain does not match the permitted domain, the email transmission of the scan data is restricted; The image forming device of claim 5, further configured to obtain scan data formed by the scanner, and create data to be sent by email to the destination email address obtained by the input screen, and to determine whether the obtained domain matches the authorized domain, and to restrict the email sending of the scan data if the obtained domain does not match the authorized domain.

8. The controller: When the destination email address is acquired, it is determined whether the acquired domain matches the permitted domain, and if the acquired domain does not match the permitted domain, the email transmission of the scan data is restricted; The image forming device of claim 1, further configured to, when email transmission of the scan data formed by the scanner fails and the scan data is to be resent, determine whether the acquired domain matches the authorized domain, and if the acquired domain does not match the authorized domain, restrict the email transmission of the scan data.

9. The controller: When sending the scanned data by email, When the acquired domain does not match the permitted domain, but a subdomain of the permitted domain included in the permitted domain list matches the acquired domain, 2. The image forming apparatus according to claim 1, wherein if the acquired domain matches a subdomain of the authorized domain that does not correspond to the group to which the login user belongs in the authorized domain list, email transmission is restricted, and if the acquired domain matches a subdomain of the authorized domain that corresponds to the group to which the login user belongs in the authorized domain list, email transmission is not restricted.

10. The image forming apparatus includes: It is possible to set an authorized address list, which is a list of email addresses that are permitted to send emails. The controller: When the scan data is to be sent by email, if the destination email address is an email address included in the permitted address list, the scan data is sent by email, and if the destination email address is an email address not included in the permitted address list, the email sending is restricted, The permitted address list includes: It is possible to set an email address included in the permitted address list to correspond to one of the multiple groups, The controller: When sending the scanned data by email, If the destination email address is an email address included in the permitted address list, but is not associated with a group to which the login user belongs in the permitted address list, If the acquired domain matches the permitted domain, but the acquired domain matches an authorized domain that does not correspond to a group to which the login user belongs in the permitted domain list, restricting email transmission; 3. The image forming apparatus according to claim 1, further comprising: a first authorized domain that is associated with the group to which the login user belongs and a second authorized domain that is associated with the group;

11. An image forming apparatus including a communication interface, a controller, and a scanner, The image forming apparatus includes: A list of permitted addresses can be set, which is a list of email addresses to which email transmission of the scan data formed by the scanner is permitted, The controller: When sending the scanned data by email, The method is configured to transmit the scan data by email when a destination email address of the email transmission is an email address included in the permitted address list, and to restrict the email transmission of the scan data when the destination email address is an email address not included in the permitted address list, The image forming apparatus includes: Multiple groups can be registered, to which multiple users who can log in can belong. The permitted address list includes: It is possible to set an email address included in the permitted address list to correspond to one of a plurality of groups, The controller: When sending the scanned data by email, an image forming device configured to restrict the email sending of the scan data if the destination email address is an email address included in the permitted address list but does not correspond in the permitted address list to the group to which the login user belongs, and to not restrict the email sending of the scan data if the destination email address is an email address included in the permitted address list and corresponds in the permitted address list to the group to which the login user belongs, and the login user is a user who is logged in to the image forming device.

12. Further comprising a non-volatile memory, The permitted address list is A plurality of pieces of email address information are stored in the non-volatile memory, and a plurality of groups can be set to correspond to each of the email addresses stored in the non-volatile memory, and a first group and a second group can be set as the groups; The controller: When sending the scanned data by email, The image forming device of claim 11, wherein if the destination email address is the email address stored in the non-volatile memory and matches the email address associated with both the first group and the second group, the image forming device is configured not to restrict the email sending of the scan data in either case where the group to which the logged-in user belongs is the first group or where the group to which the logged-in user belongs is the second group.

13. A user interface is further provided, The controller: a setting screen is displayed on the user interface in response to an operation via the user interface, the setting screen including a plurality of email addresses included in the permitted address list and a plurality of input objects for inputting the group corresponding to each of the plurality of email addresses; The controller:

13. The image forming apparatus according to claim 11, further comprising: an input object for inputting a group to the user via the input object; and an allowed address list for updating the allowed address list so that the inputted group is associated with the email address corresponding to the input object.

14. Further comprising a non-volatile memory, The permitted address list is A plurality of the email addresses are stored in a non-volatile memory, The controller: reading out the plurality of email addresses stored in the non-volatile memory in response to an operation via the user interface, and displaying the setting screen; The image forming apparatus of claim 13, further configured to update the permitted address list when input of the group is received via the input object by storing the input group in the non-volatile memory in association with the email address corresponding to the input object.

15. A user interface is further provided, The controller: an input screen is displayed on the user interface in response to an operation via the user interface, the input screen being a screen for inputting the destination email address; The controller: If the destination email address input on the input screen is an email address included in the permitted address list, but the email address does not correspond to the group to which the login user belongs in the permitted address list, and the destination email address matches the email address, restricting the use of the input destination email address for email transmission; 13. An image forming apparatus as described in claim 11 or 12, configured so that if the destination email address entered on the input screen is an email address included in the permitted address list, and if the destination email address matches the email address corresponding to the group to which the login user belongs in the permitted address list, the image forming apparatus is configured not to restrict the use of the entered destination email address for sending email.

16. The electronic mail server further includes an address book in which candidates for the destination email address are registered, The controller: among the candidates registered in the address book, a candidate corresponding to the group to which the login user belongs is set as a selection candidate for selecting the destination email address on the input screen, and a candidate not corresponding to the group to which the login user belongs is not set as a selection candidate for selecting the destination email address on the input screen, The group that can be associated with candidates registered in the address book; The image forming apparatus according to claim 15 , wherein the group that can be associated with the email address included in the permitted address list is the same as the group that can be associated with the email address included in the permitted address list.

17. The controller: When the destination email address input on the input screen is acquired, it is determined whether or not the destination email address is an email address included in the permitted address list, and if the destination email address is not an email address included in the permitted address list, the email transmission of the scan data is restricted; The image forming apparatus of claim 15, further configured to obtain scan data formed by the scanner, and create data to be sent by email to the destination email address obtained by the input screen, and to determine whether the destination email address is an email address included in the permitted address list, and to restrict the email sending of the scan data if the destination email address is not an email address included in the permitted address list.

18. The controller: When the destination email address is acquired, it is determined whether or not the destination email address is an email address included in the permitted address list, and if the destination email address is not an email address included in the permitted address list, the email transmission of the scan data is restricted; The image forming apparatus according to claim 11, further configured, when email transmission of the scan data formed by the scanner fails and the scan data is to be resent, to determine whether the destination email address is an email address included in the permitted address list, and to restrict the email transmission of the scan data if the destination email address is not an email address included in the permitted address list.

Images