Network Setup Best Practices for Salesforce

Required Domains and IP Addresses

Ensure all layers of your network are configured to allow the required Salesforce domains and IP addresses. You may also need to work with third-party vendors to ensure their domains and IPs are permitted.
For Hyperforce deployments, see Retain Uninterrupted Access to Salesforce Services on Hyperforce. A list of Hyperforce IP ranges is available on the Salesforce Compliance site.
Note: Salesforce does not block IP addresses and cannot allowlist client-side or third-party IP addresses.

Proxy

A proxy server acts as an intermediary between a user's device and the internet. Customers commonly use proxies to mask network activity or to balance load across multiple servers. If your organization uses a proxy, ensure that Salesforce domains and IP addresses are explicitly permitted through the proxy configuration.
Example: If users in a specific office cannot load Salesforce pages but other websites load normally, the office proxy may be blocking Salesforce traffic. Check proxy allow rules for *.salesforce.com and *.force.com.

Firewall

A firewall protects your organization and its users from security threats by filtering inbound and outbound network traffic. Firewalls can be configured to be more strict or more permissive. If Salesforce traffic is being blocked, ensure that firewall rules allow outbound connections to all required Salesforce IP ranges and domains.

DNS (Domain Name System)

DNS resolves domain names (such as mycompany.my.salesforce.com) to IP addresses. If DNS is misconfigured, users may receive NXDOMAIN errors or be routed to the wrong server. Always ensure your DNS settings include the correct Salesforce IP ranges, especially after org migrations or Hyperforce transitions.

VPN (Virtual Private Network)

A VPN creates an encrypted connection between a device and the internet. VPNs are one of the most common methods Salesforce customers use to secure remote access. However, VPN configurations can restrict or slow Salesforce traffic if Salesforce domains are not added to VPN allowlists or split-tunnel configurations.
Example: If multiple users in the same office experience Salesforce slowness while connected to the corporate VPN, but users connecting from home without the VPN have no issues, the VPN configuration is likely restricting Salesforce traffic. Ask your IT team to verify that Salesforce domains are permitted through the VPN.

CDN (Content Delivery Network)

A Content Delivery Network (CDN) is a group of distributed servers used to accelerate and protect data transfer. Salesforce uses a CDN to improve performance and reliability for Experience Cloud (Community) sites. If your organization uses a client-side CDN, ensure it is configured to allow Salesforce content.

Common Scenarios

The following are common network-related patterns that Salesforce Support encounters:

• Multiple users are impacted when logging into Salesforce across multiple locations, and all affected users connect via a VPN.
• Slowness or page loading issues occur on the internal network or VPN, but not on an external network.
• NXDOMAIN errors appear when accessing certain Salesforce features, with no Trust notification indicating a DNS issue.

Questions to Ask

Before opening a case, gather the following information:

• Status: Is your instance, organization, or a feature under maintenance or degradation? Review Salesforce Maintenance Notifications FAQ and Product and Service Notifications.
• Where: Is the impact in multiple geographic locations, or limited to a single connection?
• What: What type of connection do your users use? What networking layers are in place?
• When: When did this start? When does the issue occur (at login, during a specific action)?
• Who: Does this affect all Salesforce users, or only a subset (by profile, role, or location)?

Quick Links

• IP Addresses and Domains to allow
• Experience Cloud Content Delivery Networks (CDN) Overview
• Troubleshooting DNS issues
• Troubleshoot network issues with Ping and Traceroute
•  Retain Uninterrupted access to Salesforce services on Hyperforce
• compliance site
• Salesforce Maintenance Notifications FAQ
• Product and Service Notifications