How do you customize Image sources resolve and are permitted?

Set `approvedAssetHosts` when you want images served only from places you control or have vetted. It is worth doing when brand assets have been scattered across ESP-hosted uploads, agency servers and personal cloud storage, because each of those is a future broken image with a different owner. It also has a security dimension: restricting hosts limits what a compromised or expired third-party domain can put inside your email.

Stay with the empty list while you genuinely do not know where your assets live, because a host list assembled from guesswork will fail correct campaigns immediately. Keep it empty when auditing mail you did not build — an agency's proof, a partner's co-branded send — since their hosting choices are not yours to fail. If your only concern is broken and insecure sources, the default already covers it and adding a list buys nothing.

A configured host list means every legitimate new host is a failure until someone updates the list, which is friction you must be willing to own — and the temptation in a hurry is to add whatever appeared rather than to question it. Too permissive a list gives the appearance of a policy with none of its effect. Note also that adding a host list does not make the broken-source checks stricter; it adds a separate policy layer, and confusing the two leads people to think a passing host list means the images render.

The Standard behaviour is written to be useful for everyone with no setup, which is why host restriction is opt-in rather than default. An approved-host list is your organisation's asset-hosting policy and belongs with whoever owns brand assets and security review, not with an individual campaign. Review it when a platform is retired, because a list still naming a decommissioned CDN both fails good mail and hides where assets have actually gone.

A brand consolidating on its own CDN sets `approvedAssetHosts` to that domain alone, so any campaign still pulling images from an old ESP upload or an agency server fails until the asset is moved. A company working with two agencies lists its CDN plus each agency's approved delivery domain, keeping the policy enforceable without blocking live work. A team auditing a partner's co-branded send leaves the list empty, since the useful findings there are broken and insecure sources rather than a hosting policy the partner never agreed to.