9

So about a month or so ago, Salesforce released a new list of IP addresses that needed to be whitelisted. See the knowledge article below for a full list of the IP addresses

https://help.salesforce.com/HTViewSolution?id=000003652&language=en_US

We did this when they sent out the notification. On 12/28 something occurred with a group of their IP addresses that caused some sever implications for our org. It seems as though when the IPs were registered, they were not done so correctly and were not showing up as SF owned IPs, but rather as an 'unknown'. Our org, as well as many other companies have some pretty strict spam filters that bounce these unknown IPs as a possible threat.

enter image description here

This caused huge issues. Our quote approval processes were all stalled as the approval emails were being bounced. We had many emails bounced that bounced back to our Email2Case address which opened many cases (over 100k in 3 days). Basically any system generated email from SF was being bounced as being sent from a blacklisted IP.

We have been working with SF for the past day and a half, and they have temporarily moved us from the IP ranges in question, but they will not admit fault in having their IPs blacklisted (not surprising). They fully admitted to us that there were many other customers that has this same issue.

I was just wondering if this effected anyone else and if they were able to do something themselves to mitigate this or were they forced to wait for Salesforce support to unravel the mess on their end, since that is always quick and painless [sarcasm]

Improve this question
3
  • Which ip (or range) are you referring to and which blacklist was it listed on?
    – Tom Gangemi
    Commented Jan 17, 2014 at 3:32
  • The Range I was referring to was 204.14.234.64 to 204.14.234.79. I know that McAfee had it on the RBL. It seems to have been addressed but SF is STILL working on a root cause for the issue and is yet to give us any sort of explanation. Out IT team thinks what happened was SF didnt do the public PTR record registration correctly, which is why the IP was showing up as unknown. Thats out theory, but still waiting to hear back from SF. 3 weeks and still waiting.....
    – Chris Duncombe
    Commented Jan 17, 2014 at 11:45
  • whois and nslookup on those IP ranges return salesforce.com related domain names. Is the issue still occurring? As an aside the domain name in the spreadsheet you show is mxlogic.net which appears to have been a McAfee owned domain(?)
    – Steven Herod
    Commented Feb 3, 2014 at 10:47

2 Answers 2

Reset to default
1

I have not heard of any of our customers with this issue.

I must admit my full understanding of how SMTP servers are filtering out spammers these days is a bit hazy, but I would suggest two solutions:

  1. Explicitly whitelist the Salesforce IP addresses in your mail gateway.
  2. Consider enabling 'Email Relay' feature, which would allow you to route email for delivery via your own email servers: https://help.salesforce.com/apex/HTViewHelpDoc?id=email_relay.htm&language=nl
Improve this answer
2
  • Thanks. The issue was resolved within a few days. We had to involve both SF and McAfee in order to get the IPs off the Blacklist. McAfee absolutely refused to take the IPs off the blacklist until SF remedied the issue from their end (what that remedy was, I do not know). SF never actually admitted to incorrectly registering the IPs, they did admit, other customers were having the same issue and they would look into the IP acquisition business process to prevent this in the future.
    – Chris Duncombe
    Commented Feb 3, 2014 at 10:58
  • My blog is blacklisted as 'spam' by Sophos, very little opportunity to appeal it. Go figure.
    – Steven Herod
    Commented Feb 3, 2014 at 11:00
0

We were affected by another change in August this year, but we found an elegant solution I want to share:

We use SPF to define which IPs can send emails on behalf of our domains. Instead of including the Salesforce IP ranges in our SPF records, we added include:_spf.salesforce.com. This basically shifts the effort to keep the whitelist up-to-date to Salesforce. See https://help.salesforce.com/articleView?id=000232181&type=1 for details.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .