Retain uninterrupted access to Salesforce services on Hyperforce

Symptom Summary

This table summarizes the symptoms that occur when connection-related requirements aren’t met, and their resolutions.
 

Detailed Technical Requirements

Don’t Use Hard-Coded Instance References

Salesforce best practices discourage using hard-coded instance names in endpoint references.

Even in first-party infrastructure, migration that changes an org’s instance sometimes causes access disruptions if instance names are hard-coded. In public cloud, the same flexible infrastructure that enables desirable capabilities like dynamic scaling also makes it more likely that org migrations and instance maintenance include an instance change. To avoid disruptions during routine maintenance, hard-coded instance references aren’t permitted in Hyperforce.

Follow these documented best practices to identify and remove hard-coded references from your implementation:

• Use Hyperforce Assistant (Please right-click the link and select open in a new tab) to check your org for hard-coded references.
• Use Salesforce Optimizer to get a list of classes with hard-coded references.
• Use My Domain for existing integration endpoints, especially if you use Web Service Definition Language (WSDL) for integrations.
• Update all references, even if some are redirected after a previous org migration.
• Upload images directly into Knowledge Articles. Don’t rely on a URL. 
• Direct partner portals to your new URLs. 
• Check your Web-to-Lead and Web-to-Case references. 
• Update Mobile SDK apps to the latest versions.
• To maximize compatibility, enable the My Domain setting Stabilize Visualforce, Experience Builder, Site.com, and content file URLs.

You can read more about these recommendations in Updating Hard-Coded References.

Marketing Cloud Engagement Considerations

Marketing Cloud Engagement customers must enable tenant-specific OAuth endpoints. To learn more, read and follow these instructions:

• Enabling Tenant-Specific OAuth Endpoints for Marketing Cloud Connect
• Update Marketing Cloud Endpoints to Tenant-Specific Endpoints. 

Other Products

Other products that migrate to Hyperforce also will disallow hard-coded instance references. We recommend that you seek out and update instance-based hard-coded references that are used with those other services in anticipation of the product’s move to Hyperforce.

Don’t Use Hard-Coded IP Allowlists

Because of the dynamic nature of cloud environments, Salesforce recommends using mTLS as described in Preferred Alternatives to IP Allowlisting on Hyperforce, rather than IP allowlists.

The next section describes specific use cases where allowlisting was routinely used, with suggested alternatives.

Control Your User and API Client Access into Salesforce Services

If you use IP allowlists to control user or server access into Salesforce, then Allow the Required Domains.

Secure access to Salesforce domains is enforced through the use of HTTPS and SSL client certificates.

Control Requests from Salesforce Services into Customer Corporate Networks

If you use IP allowlists to filter requests from Salesforce callout features into your corporate network's hosted web services or API endpoints, be aware that allowlisting verifies the source of the request but not its authenticity. Also, these IP addresses are used by multiple customers and trial orgs; they are not unique to a single customer. For these reasons, allowlisting is insecure. Requests can include the following types:

• Apex callout (WSDL or REST based)
• Outbound messages
• Salesforce Connect (OData or Custom connector)
• Apex Invocable Action callout via Flow

Instead of allowlisting, implement modern authentication and authorization (AuthN/AuthZ) for your web services and API endpoints to ensure that only your org can access your network.

Salesforce offers these features to help you integrate security with AuthN/AuthZ:

• Authentication Settings for External Systems
• Two-way SSL Authentication with Certificates
• Using Salesforce Client Certificate for Outbound Messages

Customers who use IP allowlists must allow all of the official Hyperforce IP ranges, which can be found in JSON format at the URL https://ip-ranges.salesforce.com/ip-ranges.json. For a full explanation and best practices, read Hyperforce IPs to Allow - Sales, Service, Industries, and Tableau Clouds.

Included Services

The JSON list includes IPs for inbound connections to Hyperforce from external sources, including some for Salesforce Edge, as well as IPs for outbound connections from Hyperforce to the customer’s network. These addresses are for products built on the Salesforce platform including Sales, Service, Industries, and Tableau Clouds, and for the MuleSoft Anypoint Platform

Excluded Services

The JSON list excludes IP addresses for these services: Email, Marketing Cloud, Commerce Cloud, and Slack.

If you are a Government Cloud Plus customer, see IP Addresses to Allow for Government Cloud Plus.

Filter Email from Salesforce Services

If you use IP allowlists to bypass email blocking rules, then adopt standard email security protocols such as Transport Layer Security (TLS), Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), or Domain-based Message Authentication, Reporting, and Conformance (DMARC). Salesforce fully supports all of these options.

NOTE: While we do not recommend the use of IP allowlists for emails in general, IP addresses used by email relays on Hyperforce are more static and you can use them for your email relay needs if necessary. Those email relay IP addresses are listed in the “HYPERFORCE - Email Relay” table in Ensure you can receive email from the Salesforce application.

Find more information in these articles:

• Ensure you can receive email from the Salesforce application
• Create a DKIM Key
• Sender Policy Framework and Salesforce SPF Records

Salesforce Express Connect Considerations

Salesforce Express Connect (SEC) provides direct network connectivity to first-party SFDC infrastructure, but not to Hyperforce, which runs on Amazon Web Services (AWS). If you need a direct connectivity solution on Hyperforce for regulatory, security, or other reasons, we recommend AWS Direct Connect (DX). Salesforce doesn’t sell SEC or DX. Contact your telecom provider to set up these services. In most cases, the SEC telecom provider is also an AWS DX provider. Read more in Set Up AWS Direct Connect (DX) for Hyperforce and How to Access Salesforce Hyperforce Securely and Reliably with AWS Direct Connect.

Some Salesforce services such as login.salesforce.com and *.force.com and Marketing Cloud run in our first-party infrastructure. To maintain connectivity to all Salesforce services in first-party and Hyperforce, customers who require direct network access to Salesforce must continue to run SEC and add AWS DX. Global login endpoints are being relocated to Hyperforce in the near future. Read more in Salesforce Express Connect (SEC) Users - Prepare for Global Login Endpoint Changes.

Include Service Name Indication (SNI) for HTTPS Handshake Success

In Hyperforce, each Salesforce domain has a separate HTTPS certificate. Web browsers and API callers must specify the desired domain by including SNI in their ClientHello message, or else they can address one of the default domains.

Read more about the detailed SNI requirements, issues, and solutions in:

Resolve HTTPS/SSL connection errors in Hyperforce with SNI.
 

Don't Pin Certificates

Certificate pinning is the practice of selecting a single certificate to trust. Pinning is an outdated security practice that adds operational complexity and risks outages. Salesforce doesn't support pinning in Hyperforce. Hyperforce always employs SSL/TLS and rotates its certificates regularly. All Hyperforce certificates chain to Certificate Authorities (CAs) included on the Mozilla Server Authentication (SSL/TLS) Root Certificates list.

If you are pinning certificates in the mobile application, disable the pin by following the instructions in Configure Authentication Server Certificate Pin. If you are pinning another way, discontinue the practice. If you have an insurmountable need to pin a certificate, create a pinset that contains the entire Mozilla Server Authentication (SSL/TLS) Root Certificates list.
 

Platform Events / Streaming Clients Requirement

Orgs with Platform Events or Streaming Clients must use .NET version 5.0 or higher. Lower .NET versions might lead to disruptions to these features due to Hyperforce RFC compliance requirements. More details can be found in Microsoft's .NET documentation here.

Properly Encode Non-ASCII Characters

When passing a URI to Salesforce using a REST API, you must properly encode all non-ASCII characters using RFC-compliant percent encoding. Hyperforce has a stringent underlying architecture that doesn't permit passing unencoded characters. You can find more information about proper encoding in the RFC-3986 specification, and helpful tips in W3School's HTML URL Encoding Reference.

Update the Target Host Name for Custom Domains Served by a Third-Party Service or CDN

A custom domain serves your Digital Experiences or Salesforce Sites on a domain that you own, such as https://www.example.com.

If your custom domain uses the “Use a third-party service or CDN to serve the domain” domain configuration option, the required configuration for that domain changes during these events.

• When you upgrade to Hyperforce
• If your org uses Salesforce Edge Network, when your instance name changes (whether or not your org is on Hyperforce)
• When your org moves to Salesforce Edge Network or stops using Salesforce Edge Network

As part of planning for those events, work with your third-party provider to update the target host name for your domain immediately after the change. Otherwise, your custom domain stops working.

To determine if you have a custom domain that uses that configuration option, visit the Domains page in Setup. 

To determine whether  your org is on Salesforce Edge Network, visit the My Domain page in Setup. 

For instructions about setting the target host name for your custom domain that’s served by a third-party service or CDN, see the in the Point Your Custom Domain to Your Org with Your Target Hostname section of Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN.

Adhere to URI and Header Length Limits

For your REST API calls, the combined size of the URI and HTTP headers must not exceed the documented 16 KB limit.

Salesforce reserves additional space for its own purposes. This buffer is not for customer use and can change at any time. However, the errors for exceeding the limit--414 URI Too Long and 431 Request Header Fields Too Large--are returned when the request exceeds the combined size of 16 KB plus the Salesforce buffer. This means you may be unknowingly exceeding the documented limit.

To support advanced network features, Hyperforce may consume more of the reserved space than first-party (1P) does. Therefore, API calls that currently succeed on 1P despite exceeding the 16 KB limit may fail on Hyperforce. This isn't a Hyperforce limitation; it's an enforcement of the existing, documented limit. To avoid service disruptions, your application must strictly adhere to the 16 KB limit. Requests that exceed this limit may fail without notice, even if they initially work on Hyperforce.

If you receive either error, your API calls are significantly over 16 KB. Common culprits are long SOQL or SOSL queries. To avoid errors, send long requests using the Composite feature.

Other Issues

Content File Preview Issues

We recommend that you review the Content File Preview Issues article and understand workarounds. This issue affects both Hyperforce and first-party users.

See Also:

• Introducing Hyperforce - General Information & FAQ
• Recommended Adoption Order for MFA, Enhanced Domains, and Hyperforce
• How to prepare for org migration
• Salesforce IP Addresses and Domains to Allow
• Ensure you can receive email from the Salesforce application
• Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN
• Set Up AWS Direct Connect (DX) for Hyperforce
• Route Email Through AWS Direct Connect (DX) for Hyperforce
• API Request Limits and Allocations
• Composite
• SOQL and SOSL Limits for Search Queries