Configuring your firewall for use with Zendesk

Zendesk occasionally updates its IP addresses to ensure continued reliability and stability. To avoid a loss of access, it’s important to follow the instructions in this article.

This article describes recommendations for configuring a firewall for use with Zendesk. As part of these recommendations, a list of Zendesk’s public IP addresses are available from the Zendesk API. 

This article includes the following sections:

• About IP address configurations
• Getting the IP addresses
• Getting IP addresses for outbound email servers
• Getting IP addresses for additional Zendesk products

About IP address configurations

• If your server policy restricts inbound traffic only, creating an allowlist with the list of IP addresses should suffice.
• If you filter both inbound and outbound traffic:
  • Zendesk highly recommends creating an allowlist with both the fully qualified domain name (FQDN) of your Zendesk subdomain as well as the IP addresses you get using the Zendesk API. 
  • If the firewall doesn’t support creating an FQDN-based allowlist, Zendesk recommends you disable outbound filtering or upgrade to a firewall that supports this feature rather than try to restrict outbound traffic using IP addresses only, which can cause issues.
  • If you can’t disable outbound filtering or upgrade your firewall, you can temporarily work around this by resolving your FQDN to an IP address using a DNS lookup tool. However, because the IP address can change at any time, Zendesk doesn't recommend using this method.

Getting the IP addresses

You can use the Zendesk API to get the most-recent list of IP addresses.

To get the IP addresses

• Use the following Get Zendesk Public IPs endpoint in the Zendesk API to list the main Zendesk ingress and egress IP addresses:
  

  https://{your-subdomain}.zendesk.com/ips

The endpoint doesn’t require authentication so you can use it in a web browser.

IP addresses are listed using Classless Inter-Domain Routing (CIDR) notation. You can convert IP addresses using a CIDR utility tool. 

Getting IP addresses for outbound email servers

The IP addresses of outbound email servers are listed in our SPF record, which we update as needed.

• Our SPF record can be read using a lookup tool or by using these commands:
  

  host -t TXT mail.zendesk.com
  

  or

  dig txt mail.zendesk.com

Note: Due to server and IP rotation on our mail server's end, we do not support the use of IPs to validate your record. While using IPs may work within the SPF record, it's likely to cause issues down the road, when an IP or mail server rotation occurs. 

Getting IP addresses for additional Zendesk products

Some Zendesk products require additional IP addresses. 

• Zendesk Talk
  If you’re using Zendesk Talk, specific IP addresses need to be accessible. For a list of IP addresses, see Talk network requirements.
• Zendesk Chat
  If you’re using Zendesk Chat, specific IP addresses might need to be accessible. For details on how to configure your firewall for Chat, see Zendesk Chat system requirements.
• JIRA integration (Pod 19)
  18.233.240.4/32
  35.171.179.180/32
  54.88.153.44/32
  216.198.0.0/18
• Zendesk Explore
  If you're using Zendesk Explore, specific IP addresses need to be accessible. See Allowing network IP addresses for Explore.
• Zendesk Sell 
  If you're using Zendesk Sell, specific IP addresses need to be accessible to support Sell email integration. See Configuring allowlist IP addresses
• Zendesk Marketplace
  If you're using Zendesk Marketplace or other pages located on www.zendesk.com, specific IP addresses need to be accessible. Contact Zendesk Customer Support for more information.