3/30/2021 Salesforce IP Addresses and Domains to Allow

 KNOWLEDGE ARTICLE

Salesforce IP Addresses and Domains to Allow

Knowledge Article Number 000321501

Description At Salesforce, trust is our #1 value. We understand that our customers need
to be confident that they are communicating with Salesforce in a secure
environment.  Allowing designated IPs is one of the most effective methods
of ensuring this and prevents any internet traffic intended for Salesforce from
being hijacked or rerouted to a rogue website. Our complete portfolio of IP
addresses and Domains are outlined below for our customers to reference
when establishing and maintaining their corporate network and email
settings.

We have exclusive ownership of every public IP address that we use. The IP

addresses that we use have been allocated directly to us by The American
Registry for Internet Numbers (ARIN), The Asia Pacific Network Information
Centre (APNIC), and Réseaux IP Européens (RIPE) or assigned to us by one of
our partners from the same Regional Internet Registries. These organizations
are coordinated by the Internet Assigned Numbers Authority (IANA) and the
Internet Corporation for Assigned Names and Numbers (ICANN).

If you allow designated IPs, we recommend bookmarking and revisiting this

article regularly to stay informed with IP ranges and addresses that may be
added or removed at any time. It is especially important to ensure you have
included any new IPs in advance of any infrastructure activities such as
Instance Refreshes, Site Switches, and Org Migrations. For more information
about our infrastructure best practices, visit the Plan and Prepare for Org
Maintenance and Releases site.

NOTE: This information is subject to change and we recommend that you

check back quarterly for the addition of new IP ranges. A chart outlining the
revision history over the past 6 months can be found at the end of the article.

This article was last updated on: February 11, 2021

Resolution  

Article Contents
Salesforce's IP Ranges

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 1/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

Community Cloud IP Ranges

API Integrations

Firewalls

Required Domains

Salesforce URLs not in our infrastructure

Feature-Specific IP Addresses

Email Security Filters

myTrailhead Outbound IP Addresses

Revision History

Salesforce’s IP Ranges
Salesforce does not offer static IP addresses or small ranges of IP addresses
for individual instances. All IP ranges are provided in Classless Inter-Domain
Routing (CIDR) notation. For more information on CIDR please see Classless
Inter Domain Routing on Wikipedia.

Recommended for seamless access: Our best practice is to allow our

entire set of IP ranges. This is to ensure our login pools can process your end
users’ and integrations’ login authentications when accessing Salesforce all
over the world, and to avoid any unintended service disruptions due to
movement between data center sites.

Required for access: Our recommended best practice is to allow our entire
list of IP ranges. However, if you choose to only allow a subset of our list of
IP ranges, you must do so according to the instructions below in order to
avoid unintended service disruptions. As a global company, we distribute our
provisioned IP ranges across our infrastructure; therefore, certain regions
may have ranges from multiple Regional Internet Registries (i.e. RIPE, ARIN,
APNIC).
 

If you have end-users with multi-national internet entry points, then

you should allow all IP ranges. This includes remote offices and traveling
users. For example, if you have an employee traveling to Tokyo and you
do not allow the APNIC numbers, the employee may not be able to log in
as our login pools would not be able to process their authentication due
to blocking on your side.

If your org is not on a Public Cloud instance and you would prefer
not to allow Public Cloud IP ranges, you do not need to allow Public
Cloud (Canada, Australia) IP ranges.

If you are a Hyperforce customer, all domains under "

Required Domains" are required for ingress access, in addition to the IP
https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 2/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

ranges below. With the Instancesless My Domain feature as the de-facto

option, ingress IP addresses will no longer be published for Hyperforce
customers.

If your internet entry points are all contained within the NA region,
then you may allow only the ARIN numbers.

If your internet entry points are all contained within the APAC
region, then you may allow only the APNIC and ARIN numbers.

If your internet entry points are all contained within the EMEA
region, then you may allow only the RIPE and ARIN numbers.

If your internet entry points are all contained within Canada AND
your only Salesforce org(s) is/are on a Canada instance, then you may
allow only Canada ARIN numbers.

If your internet entry points are all contained within Australia AND
your only Salesforce org(s) is/are on an Australia instance, then you
may allow only Australia ARIN numbers.

If you are using Communities, you must allow the Community IP

ranges listed in the Community IP Settings section below.

If you are located in any regions not listed above, allow the ranges
related to the region where your org's instance is located as a priority, and
then allow all other regional ranges as a best practice.

Please be reminded that our best practice and recommendation is to

allow the entire list of Salesforce IP ranges for seamless access.

Our Network Engineering team recommends that customers allow the

following subnet mask IPs:
 
IPv4 Network IPv4 IP Range

ARIN

13.108.0.0/14 13.108.0.0 - 13.111.255.255

66.231.80.0/20 66.231.80.0 - 66.231.95.255

68.232.192.0/20 68.232.192.0 - 68.232.207.255

96.43.144.0/20 96.43.144.0 - 96.43.159.255

128.17.0.0/16 128.17.0.0 - 128.17.255.255

128.245.0.0/16 128.245.0.0 - 128.245.255.255

136.146.0.0/15 136.146.0.0 - 136.147.255.255

198.245.80.0/20 198.245.80.0 - 198.245.95.255

199.122.120.0/21 199.122.120.0 - 199.122.127.255

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 3/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

IPv4 Network IPv4 IP Range

204.14.232.0/21 204.14.232.0 - 204.14.239.255

Canada (Public Cloud)

52.60.248.0/22 52.60.248.0 - 52.60.251.255

52.60.252.0/22 52.60.252.0 - 52.60.255.255

Australia (Public Cloud)

13.210.4.0/22 13.210.4.0 - 13.210.7.255

13.210.8.0/22 13.210.8.0 - 13.210.11.255

13.210.180.120/32  

13.238.98.67/32  

54.252.37.181/32  

India (Public Cloud)

3.6.203.25/32  

13.127.212.138/32  

15.206.226.165/32  

15.207.181.18/32  

15.207.182.186/32  

65.0.79.252/32  

US-East (Public Cloud)

3.225.240.254/32  

18.204.28.162/32  

18.214.12.209/32  

34.202.86.120/32  

34.204.111.166/32  

52.44.156.44/32  

US-West (Public Cloud)

44.233.69.21/32  

44.237.79.66/32  

52.36.20.11/32  

RIPE

85.222.128.0/19 85.222.128.0 - 85.222.159.255

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 4/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

IPv4 Network IPv4 IP Range

159.92.128.0/17 159.92.128.0 - 159.92.255.255

160.8.0.0/16 160.8.0.0 - 160.8.255.255

161.71.0.0/17 161.71.0.0 - 161.71.127.255

163.76.128.0/17 163.76.128.0 - 163.76.255.255

163.79.128.0/17 163.79.128.0 -163.79.255.255

185.79.140.0/22 185.79.140.0 - 185.79.143.255

APNIC

101.53.160.0/19 101.53.160.0 - 101.53.191.255

104.161.128.0/17 104.161.128.0 - 104.161.255.255

161.32.64.0/18 161.32.64.0 - 161.32.127.255

161.32.128.0/17 161.32.128.0 - 161.32.255.255

161.71.128.0/17 161.71.128.0 - 161.71.255.255

182.50.76.0/22 182.50.76.0 - 182.50.79.255

202.129.242.0/23 202.129.242.0 - 202.129.243.255

Our Network Engineering team additionally recommends that customers

allow the following IP addresses:
 
Region  Connections to Salesforce Connections from Salesforce

USA 3.228.190.251 3.225.151.145

34.206.116.149 3.225.240.254/32
35.174.143.92 18.204.28.162/32
52.203.77.201 18.211.105.61
54.156.107.163 34.197.58.108
54.158.77.4 34.204.111.166/32
54.163.166.54 52.3.16.30
54.83.60.38 52.22.251.194
107.21.202.122 52.70.135.185

NOTE: Salesforce Support occasionally receives requests for a subset range of

IPs to allow. Be advised that our best practice and recommendation is to
allow the entire list of Salesforce IP ranges for seamless access. Narrowing
the range of IPs would put you at greater risk of interrupted access for you
and your users.

Back to Top

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 5/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

Community Cloud IP Ranges

The following table contains the specific range allocated to Community

cloud. It is advisable to allow the entire range of Community Cloud IPs below
for seamless access.
 
IPv4 Network IPv4 IP Range

13.109.128.0/19 13.109.128.0 - 13.109.159.255

13.109.160.0/21 13.109.160.0 - 13.109.167.255

13.109.192.0/19 13.109.192.0 - 13.109.223.255

101.53.176.0/20 101.53.176.0 - 101.53.191.255

160.8.0.0/21 160.8.0.0 - 160.8.7.255

161.71.16.0/20 161.71.16.0 - 161.71.31.255

161.71.40.0/22 161.71.40.0 - 161.71.43.255

161.71.176.0/21 161.71.176.0 - 161.71.183.255

182.50.76.0/22 182.50.76.0 - 182.50.79.255

Back to Top

API Integrations
API integrations use the same set of IP ranges as the Salesforce website.
Please use the IP ranges listed in Salesforce’s IP Ranges above.

Back to Top

Firewalls

Allowing designated IPs can occur at several different points on a customer’s

network, but the most common place is the firewall. When adding or
updating IPs allowed, please ensure that any IP restrictions on your firewall
match the described information in this article.
 
Back to Top

Required Domains
https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 6/12
3/30/2021 q Salesforce IP Addresses and Domains to Allow

If your company has policies to allow only Salesforce domains, please include
the domains in the article, Required Domains, to ensure you receive all
content from Salesforce:

If you are using Force.com sites, and you want to set up domain name-based
filtering, you will need to add in your My Domain (subdomain) followed by
secure.force.com to access your site (e.g. https://[MyDomainName].
secure.force.com).

Akamai’s content delivery network (CDN) for static Lightning components is

now enabled in all new and existing communities. Additionally, the CDN for
Lightning Component framework is also now available. A CDN speeds up
page load time by storing cached versions in multiple geographic locations.
This setting turns on Lightning CDN delivery for the static JavaScript in the
Lightning Component framework. For more information review the release
note, Enable CDN to Load Lightning Experience Faster. If you experience
issues, ensure that https://static.lightning.force.com is added to any allowed
list or firewall that your company operates, and ask your IT department if
your company’s firewall blocks Akamai CDN content.

Back to Top

Salesforce URLs not in our infrastructure

If you need to allow specific URLs for internal routing (also known as URL
filtering), please include the following URLs in your network settings:
 

Developer.Salesforce.com

Trailhead.Salesforce.com

Feature-Specific IP Addresses
News, Account Logos, and Automated Account Fields - In order to
leverage these
features, you will need to allow the IP addresses and domains listed in
Allow Network Access for News, Account Logos, and Auto
mated Account Fields .

Salesforce Inbox - For seamless usage, visit the 

Salesforce Email Integration Security Guide for a specific list of IP
addresses to allow.

Salesforce Mobile - For improved performance, be sure to allow the

IPs listed in Salesforce Edge Mobile IP Allowlist.

Salesforce Identity for myTrailhead - To use Salesforce Identity for

myTrailhead in a Salesforce org that has IP restrictions configured, allow

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 7/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

the IP addresses listed in the myTrailhead Outbound IP Addresses

section.

Back to Top

Email Settings

NOTE: If you are a Gov Cloud customer, please refer to the IP Addresses to
Allow for Government Cloud article for Email Settings details specific to your
organization.
 

Email Security Filters

Salesforce sends email from a variety of IP addresses. If your organization

blocks any of these IP addresses, users may not receive all email sent from
Salesforce. In order to ensure that your organization’s users receive all
Salesforce emails, verify that the following IP addresses are allowed in your
email server firewall.

NOTE: For all IP addresses related to receiving email from Salesforce, please
refer to the Ensure you can receive email from the Salesforce application
article.

Back to Top

myTrailhead Outbound IP Addresses

myTrailhead customers who choose Salesforce Identity for myTrailhead as
their authentication provider may need to enable the following myTrailhead
outbound IP addresses in their Salesforce org. If your org blocks any of these
IP addresses and you use Salesforce Identity for myTrailhead, you users may
not be able to log in to myTrailhead.
 
myTrailhead Outbound IP Addresses

52.6.127.225

52.205.38.38

52.205.40.33

52.205.41.207

Back to Top

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 8/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

Revision History
Revisions made approximately within the past 6 months:
 

Date Revised Revisions

February 11, Added to "Salesforce IP Ranges" under "US-West (Public

2021 Cloud)":
- 44.233.69.21/32
- 44.237.79.66/32
- 52.36.20.11/32

January 13, Added to "Salesforce IP Ranges" under "Australia (Public

2021 Cloud)":
- 13.210.180.120/32    
- 13.238.98.67/32    
- 54.252.37.181/32

January 6, Added note under "Salesforce IP Ranges" for Hyperforce

2021 customers:

"If you are a Hyperforce customer, all domains under

"Required Domains" are required for ingress access, in
addition to the IP ranges below. With the Instancesless My
Domain feature as the de-facto option, ingress IP addresses
will no longer be published for Hyperforce customers." 

December 1, Removed all IPs and details noted under the "Email
2020 Settings" heading and replaced with a link to their new
location: Ensure you can receive email from the
Salesforce application.

All information from the following sections has migrated

to the new article:

- Email Security Filters

- IPv4 Networks
- Trialforce Org Emails
- Email Relaying - Chatter and Communities
- Email Relaying - System Mail
- Email Relaying - Email Relay

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 9/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

Date Revised Revisions

November Added to "Salesforce IP Ranges" under "India (Public

19, 2020 Cloud)":
- 3.6.203.25/32
- 15.206.226.165/32
- 15.207.181.18/32
- 15.207.182.186/32
- 65.0.79.252/32

Removed from "Salesforce IP Ranges" under "India

(Public Cloud)":
- 15.207.201.97/32
- 15.207.241.19/32

Added to "Salesforce IP Ranges" under "US-East (Public

Cloud)":
- 3.225.240.254/32
- 18.204.28.162/32
- 34.204.111.166/32

Added to "Salesforce IP Ranges" under "Connections

from Salesforce":
- 3.225.240.254/32
- 18.204.28.162/32
- 34.204.111.166/32

Added new section for "myTrailhead Outbound IP

Addresses":
- 52.6.127.225
- 52.205.38.38
- 52.205.40.33
- 52.205.41.207
 

November 8, Added to "Email Relay - ARIN" under "Email Relaying":

2020 - 13.110.74.193
- 13.110.78.193
- 160.1.157.146
- 52.61.135.176

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 10/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

Date Revised Revisions

October 13, Added to "Salesforce IP Ranges" under "India (Public

2020 Cloud)":
- 13.127.212.138/32
- 15.207.201.97/32
- 15.207.241.19/32

Added to "Salesforce IP Ranges" under "US-East (Public

Cloud)":
- 18.214.12.209/32
- 34.202.86.120/32
- 52.44.156.44/32

Removed from Salesforce IP Ranges under "Our Network

Engineering team additionally recommends that
customers allow the following IP addresses:"
- 13.127.212.138/32
- 15.207.181.18/32
- 15.207.182.186/32
- 18.214.12.209
- 34.202.86.120
- 52.44.156.44

September Added to "Salesforce IP Ranges" under "Connections

29, 2020 from Salesforce":
- 13.127.212.138/32
- 15.207.181.18/32
- 15.207.182.186/32
 

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 11/12
3/30/2021 Salesforce IP Addresses and Domains to Allow

Date Revised Revisions

September Added to "Email Security Filters":

18, 2020  
85.222.150.192/28 85.222.150.192 - 85.222.150.207

85.222.158.192/28 85.222.158.192 - 85.222.158.207

Added to "Trialforce Org Emails":

- 85.222.150.207
- 85.222.158.207

Added to "Chatter and Communities":

- 85.222.158.195
- 85.222.158.196
- 85.222.150.195
- 85.222.150.196

Added to "System Mail":

- 85.222.150.192
- 85.222.158.192

Added to "Email Relay":

- 85.222.150.193
- 85.222.158.193
 

August 12, Added section for Salesforce Unified Cloud Infrastructure IP

2020 Ranges above Community Cloud IP Ranges:

Our Network Engineering team additionally recommends

that customers allow the following IP addresses:

Region Connections to Connections from

Salesforce Salesforce

USA 3.228.190.251 3.225.151.145

34.206.116.149 18.211.105.61
35.174.143.92 18.214.12.209
52.203.77.201 34.197.58.108
54.156.107.163 34.202.86.120
54.158.77.4 52.3.16.30
54.163.166.54 52.22.251.194
54.83.60.38 52.44.156.44
107.21.202.122 52.70.135.185

Back to Top

https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 12/12