Ensure You Can Receive Email From Salesforce

What do we recommend?

Instead of allow lists, we recommend relying on standard email security protocols - TLS, SPF, DKIM and DMARC. Salesforce supports everything you need in order to set up your mail to be safely sent from Salesforce and received by your organization's email services using these standards.  For more information on deliverability settings for emails sent from Salesforce, see this Help page.
 
If you absolutely insist on using an allow list, we are providing the high level ranges below that we use to send email. We do our best to keep this list up to date but please be advised that due to rapid expansion and growth the list is subject to change at any time.

Hyperforce Customers: IP allowlisting requires vigilant maintenance when new instances come online. As Hyperforce rapidly scales, we expect the manual overhead of maintaining IP allowlists to become unmanageable for customers, resulting in potential service disruptions. To ensure you can properly receive mail sent from the Salesforce platform, the best practice is to rely on the standard email security protocols mentioned above. For information about other Hyperforce services, please refer to the Retain uninterrupted access to Salesforce services on Hyperforce article.

If an Allow List is required - See below for Core Mail Transfer Agent (MTA) ranges:

In this example, if the IP range is 13.108.238.128, 13.108.238.129, 13.108.238.130...13.108.238.143 then the following is true:

• The first IP in each range is the IP used for System email (13.108.238.128)
• The 2nd IP in each range is the IP used for Email Relay (13.108.238.129)
• The ranges are all CIDR blocks /28

With the introduction of Hyperforce, we will no longer publish specific CIDR blocks for IPs used for email. IPs used with these instances are no longer contained to specific CIDR blocks and are more dynamic. Allow lists for non-relayed mail do not work as efficiently or fluidly as current authentication mechanisms such as SPF/DKIM/DMARC. (See "If you are a Hyperforce customer" above)

IPs used for email relay MTAs for Hyperforce instances are more static and are listed below:

Securing Email Relay

Salesforce supports the ability for customers to relay mail through their own servers which in turn send the mail to the Internet rather than having the mail egress directly from Salesforce servers. There are many reasons customers may choose to do this - auditing requirements, internal policy or security requirements, etc … This relay is a server to server relay (not client to server which uses auth smtp). When a customer sets up relay, we typically suggests they do the following things to ensure the relay is secure:

• Configure Salesforce relay to utilize TLS (optionally require TLS or required verify to verify the hostname on the receiver's certificate).
• Configure the receiving MTA to check the sender's certificate and domain name to ensure it matches the certificate presented.
• Configure the receiving MTA to ensure that the sending domain is your email domain
• Configure the receiving MTA to verify that there is an X-SFDC-LK header with your orgid in it
• Set up DKIM signing in Salesforce
• Configure the receiving MTA to verify that DKIM passes and that the domain it was signed for is your domain.
• Configure SMTP Auth (if it works with your MTA)
• Configure the receiving MTA to only allow mail sent from the Salesforce relay IPs (and any other IPs you expect mail from) You may not need this if you can use SMTP Auth or rely on DKIM - using allow lists is dynamic and needing manual maintenance and thus problematic. We don’t recommend doing this approach.

Issues Receiving Email

If you are experiencing issues receiving email from Salesforce, please check with your IT/Network department or the person managing your system to ensure that:

• Antivirus system is not blocking Salesforce emails (including how your rules and filters are setup)
• SPF, DKIM, and DMARC are properly configured
• Firewall is not blocking IPs
• Mail is arriving in the SPAM folder
• Issues with TLS - notes Salesforce currently only supports TLS 1.2 for email encryption
• TLS Mail Delivery - Supported TLS Cipher suites  
• Review the Troubleshoot Delivery Problems for Salesforce Emails article.

History & Dates of recent revisions of this article: