IP allowlisting is no longer a Salesforce security best practice as it requires vigilant maintenance when new instances come online. As Hyperforce rapidly scales, we expect the manual overhead of maintaining IP allowlists to become unmanageable for customers, resulting in potential service disruptions.
With Government Cloud Plus on Hyperforce architecture, IP addresses can change frequently and without prior warning, requiring customers to update their IP addresses at the same rate. As such, Salesforce strongly recommends all customers allow the required domains and your My Domain to avoid the need to update IP allowlists frequently.
Should customers still need to maintain allowlists due to insurmountable business or compliance requirements, this document provides the list of allowed Government Cloud Plus IP addresses.
NOTE: All IP addresses are subject to change at any time without prior warning.
NOTE: The IP ranges below don’t apply to customers using a .mil My Domain with Government Cloud Plus - Defense. To obtain our NIPRNet IP ranges, reference the Ports, Protocols, and Services Management (PPSM) file made available with our DoD compliance documentation via our Public Sector Compliance Documentation Portal: Access Government Cloud Compliance Documentation.
For the complete list of all Commercial Salesforce IP addresses and domains, see Salesforce IP Addresses and Domains to Allow.
**The newest IP addresses are indicated in bold.
IP addresses are identified by associated instances. To identify your Government Cloud Plus instance, visit View instance information for your Salesforce Organization.
The IP addresses below enable general connections to Salesforce, including inbound API and Browser connections:
|
Instance |
Inbound IP Addresses |
|
USA9002 |
18.253.163.201 18.254.64.73 18.254.158.140 |
|
USA9002 - Custom Domain |
18.252.199.17 18.253.117.20 18.253.252.111 |
|
USA9004s |
18.252.213.12 18.253.83.198 18.253.223.165 |
|
USA9004s - Custom Domain |
18.254.86.53 18.254.208.143 18.254.242.45 |
|
USA9006s |
18.252.128.210 18.252.168.93 18.253.209.151 |
|
USA9006s - Custom Domain |
18.252.22.28 18.253.80.222 18.254.207.239 |
|
USA9008 |
18.254.92.188 18.254.116.174 182.30.1.8 |
|
USA9008 - Custom Domain |
18.252.155.114 18.253.118.54 182.30.19.218 |
|
USA9010s |
18.252.138.213 18.254.112.65 18.254.154.92 |
|
USA9010s - Custom Domain |
18.252.207.237 18.254.255.161 182.30.25.141 |
|
USA9012s |
18.252.16.198 18.254.95.81 18.254.157.183 |
|
USA9012s - Custom Domain |
18.252.243.65 18.253.155.234 18.254.81.182 |
|
USA9014 |
18.253.97.243 18.253.156.83 18.254.252.205 |
|
USA9014 - Custom Domain |
182.30.12.44 182.30.19.253 182.30.27.130 |
|
USA9016s |
18.253.79.149 18.254.195.201 18.254.238.186 |
|
USA9016s - Custom Domain |
18.254.60.169 18.254.66.102 18.254.111.125 |
|
USA9018s |
18.252.190.9 18.252.225.41 18.254.70.57 |
|
USA9018s - Custom Domain |
18.253.115.71 18.254.66.88 182.30.7.11 |
|
USA9020 |
18.252.16.26 |
|
USA9020 - Custom Domain |
18.252.90.129 |
|
USA9022s |
18.252.172.171 |
|
USA9022s - Custom Domain |
18.252.210.130 |
|
USA9024s |
18.254.147.238 |
|
USA9024s - Custom Domain |
18.254.254.249 |
|
USA9026 |
182.30.4.254 |
|
USA9026 - Custom Domain |
18.252.215.160 18.252.254.55 182.30.128.143 |
|
USA9028s |
182.30.83.162 |
The IP addresses below enable Email Delivery:
|
Instance |
IP Addresses Enabling Email Delivery |
|
USA9002, USA9008, USA9014, USA9020, USA9026 USA9004s, USA9006s, USA9010s, USA9012s, USA9016s, USA9018s, USA9022s, USA9024s, USA9028s |
18.252.111.11 18.252.115.73 18.252.118.67 18.252.123.43 18.252.124.241 18.252.162.68 18.252.177.157 18.252.184.216 18.252.206.127 18.252.219.112 18.252.96.59 18.253.102.163 18.253.156.10 18.253.200.131 18.253.210.110 18.253.248.130 18.253.252.54 18.253.37.6 18.253.77.55 18.254.10.163 18.254.103.190 18.254.110.166 18.254.115.224 18.254.116.254 18.254.121.102 18.254.128.163 18.254.152.146 18.254.155.196 18.254.156.154 18.254.157.7 18.254.158.174 18.254.162.163 18.254.163.11 18.254.17.214 18.254.186.215 18.254.186.97 18.254.19.125 18.254.190.212 18.254.196.54 18.254.196.78 18.254.197.102 18.254.201.109 18.254.201.53 18.254.29.173 18.254.31.117 18.254.60.55 18.254.75.237 18.254.85.178 18.254.88.147 18.254.89.101 18.254.95.39 |
Outbound API calls from Salesforce will come from the following IP addresses:
|
Instance |
Outbound API calls from Salesforce |
|
USA9002, USA9008, USA9014, USA9020, USA9026 USA9004s, USA9006s, USA9010s, USA9012s, USA9016s, USA9018s, USA9022s, USA9024s, USA9028s
|
18.252.112.160 18.252.114.180 18.252.170.226 18.253.34.110 18.253.242.236 18.254.32.123 |
Government Cloud Plus customers may choose to restrict authorization of Salesforce Commercial IP addresses and instead leverage Sender Policy Framework (SPF) records to validate the legitimacy of inbound traffic.
SPF is a simple email validation system designed to detect email spoofing. SPF provides a process to verify which providers can send emails on your behalf. It also aims to reduce spam and fraud by making it harder for anyone to hide their identity. For more on SPF at Salesforce, see: Sender Policy Framework and Salesforce SPF Records and Include Salesforce in Your SPF Record.
To enable SPF records for Government Cloud Plus, include the domain _spfg.salesforce.com in your SPF record when sending mail from the Salesforce application.
Sample SPF record: v=spf1 mx include:_spfg.salesforce.com -all
See also:
View instance information for your Salesforce Organization
000386297

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.