Configuring your firewall for use with Zendesk

What's my plan?

All Suites | Team, Growth, Professional, Enterprise, or Enterprise Plus

Support | Team, Professional, or Enterprise

Zendesk occasionally updates its public-facing IP addresses to ensure continued reliability and stability for its customers. This article guides IT administrators on configuring your organization’s firewall for use with Zendesk, ensuring service availability during these updates.

This article includes the following topics:

About Zendesk's IP addresses

Customizing your IP address configurations

Getting IP addresses for additional Zendesk products

About Zendesk's IP addresses

Zendesk has removed some AWS IP addresses from use and consolidated those public IPs to a single address range (216.198.0.0/18) that Zendesk exclusively owns.

This transition enhances network efficiency and streamlines firewall configuration for our customers by ensuring any IPs rotated in the Zendesk infrastructure are never repurposed by another entity besides Zendesk. It also ensures any necessary IP changes to protect our customers from internet outages or other service-impacting incidents wouldn't require customers to make subsequent changes to their firewall ACLs.

Customizing your IP address configurations

Use the Zendesk IP API to retrieve your Zendesk subdomain’s inbound and outbound IP addresses: https://{your-subdomain}.zendesk.com/ips.

Update your allowlists to include the supplied ranges.

If your agents use any of the Zendesk products listed in Getting IP addresses for additional Zendesk products, add those IP addresses to your allowlists as well. You can find the products included in your organization’s Zendesk plan here.

The addresses listed on https://{your-subdomain}.zendesk.com/ips do not include the IP ranges for emails sent by Zendesk's mail servers.
To discover the additional IPs, open any popular Domain Information Grouper (DIG) tool and enter the following command:
dig txt mail.zendesk.com +short
The IP addresses returned by the DIG tool do not apply to messages sent via the Gmail Connector or Exchange Connector.

Important notes

The Zendesk IP API doesn't return retired AWS IP addresses or product-specific IP addresses.  Refer to Getting IP addresses for additional Zendesk products to retrieve the complete list of Zendesk IPs required for your firewall configuration.

Zendesk supports FQDN-based allowlists on a very limited basis. Contact Zendesk Customer Support if this is a required configuration.

Getting IP addresses for additional Zendesk products

Some Zendesk products and features require additional IP addresses in addition to Zendesk’s public IP range. Please refer to the following articles relevant to your use case.

Zendesk Talk

Zendesk Chat

Zendesk Explore

Zendesk Guide: Add uploaded-assets-*.s3.*.amazonaws.com.

AI agents - Advanced

Zendesk WFM

Zendesk QA: 34.159.180.83, 34.141.81.127, 34.40.37.64, 34.107.48.207, 35.246.215.216, 35.246.44.146

Data importer: Add *-data-importer*.s3.*.amazonaws.com.

Advanced Data Privacy and Protection (ADPP) add-on: Add the IP addresses from this URL: https://www.cloudflare.com/ips/

Zendesk Marketplace or other pages located on www.zendesk.com - contact Zendesk Customer Support.

Zendesk Sell

Note: Zendesk is continuously monitoring the adoption of IPv6 support across our customer base. At this juncture, IPv6 is not supported on our ingress or egress traffic due to the prevalence of IPv4-only or dual stack environments. We will continue to monitor these changes to ensure compatibility.