diff --git a/Main/sogod.m b/Main/sogod.m
index 37eb0f50f..22b441c0c 100644
--- a/Main/sogod.m
+++ b/Main/sogod.m
@@ -34,6 +34,7 @@ main (int argc, char **argv, char **env)
 {
   NSAutoreleasePool *pool;
   SOGoSystemDefaults *sd;
+  NSArray *baseUrls;
   int rc;
 
   /* Here we work around a bug in GNUstep which decode XML user defaults using
@@ -54,7 +55,15 @@ main (int argc, char **argv, char **env)
         rc =-1;
         NSLog (@"Sogo secret is not correctly set");
       }
-      else
+
+      //Check sogo base urls
+      if(!((baseUrls = [sd baseURLs]) && [baseUrls count] > 0))
+      {
+        rc = -1;
+        NSLog (@"SOGoBaseUrls is not set or empty");
+      }
+      
+      if(rc == 0)
       {
         WOWatchDogApplicationMain (@"SOGo", argc, (void *) argv);
       }
diff --git a/SoObjects/SOGo/SOGoSystemDefaults.h b/SoObjects/SOGo/SOGoSystemDefaults.h
index a7e29c82c..4a4c1607a 100644
--- a/SoObjects/SOGo/SOGoSystemDefaults.h
+++ b/SoObjects/SOGo/SOGoSystemDefaults.h
@@ -57,6 +57,7 @@ static const NSString *kDisableSharingCalendar = @"Calendar";
 - (NSString *) sogoSecretValue;
 - (BOOL) useRelativeURLs;
 - (NSString *) sieveFolderEncoding;
+- (NSArray *) baseURLs;
 
 - (BOOL) isWebAccessEnabled;
 - (BOOL) isCalendarDAVAccessEnabled;
diff --git a/SoObjects/SOGo/SOGoSystemDefaults.m b/SoObjects/SOGo/SOGoSystemDefaults.m
index abca1d906..2eb6dd455 100644
--- a/SoObjects/SOGo/SOGoSystemDefaults.m
+++ b/SoObjects/SOGo/SOGoSystemDefaults.m
@@ -724,6 +724,12 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return [self stringForKey: @"SOGoLoginSuffix"];
 }
 
+- (NSArray *) baseURLs
+{
+  return [self stringArrayForKey: @"SOGoBaseUrls"];
+}
+
+
 - (NSString *) authenticationType
 {
   return [[self stringForKey: @"SOGoAuthenticationType"] lowercaseString];
diff --git a/UI/MainUI/SOGoRootPage.m b/UI/MainUI/SOGoRootPage.m
index 90b392acf..c5e4bf015 100644
--- a/UI/MainUI/SOGoRootPage.m
+++ b/UI/MainUI/SOGoRootPage.m
@@ -1316,7 +1316,8 @@ static const NSString *kJwtKey = @"jwt";
  */
 - (WOResponse *) passwordRecoveryEmailAction
 {
-  NSString *username, *domain, *mode, *uid, *mailDomain, *fromEmail, *toEmail, *jwtToken, *url, *mailContent, *email;
+  NSString *username, *domain, *mode, *uid, *mailDomain, *fromEmail, *toEmail, *jwtToken, *url, *mailContent, *email, *serverUrl;
+  NSArray *baseUrls;
   NSDictionary *message, *info;
   WORequest *request;
   SOGoUserManager *um;
@@ -1372,8 +1373,19 @@ static const NSString *kJwtKey = @"jwt";
           // Send mail
           mailer = [SOGoMailer mailerWithDomainDefaults: dd];
 
-          url = [NSString stringWithFormat:@"%@/%@?token=%@"
-                      , [[context serverURL] absoluteString]
+          //Get Allowed server URL and check if it's OK
+          baseUrls = [[SOGoSystemDefaults sharedSystemDefaults] baseURLs];
+          serverUrl = [[request headers] objectForKey:@"origin"];
+
+          if(![baseUrls containsObject:serverUrl])
+          {
+            [self logWithFormat: @"Password recovery exception for user %@: invalid request header", uid];
+            response = [self responseWithStatus: 403
+                              andString: @"Password recovery email in error"];
+          }
+
+          url = [NSString stringWithFormat:@"%@%@?token=%@"
+                      , serverUrl
                       , [request uri]
                       , jwtToken];