0

I'm just wondering: We make a number of callouts from Salesforce to different APIs, and so obviously we need to whitelist their respective domains with Remote Site Settings. However, I'm wondering whether it is possible to whitelist specific IP addresses in this way, in order to protect against DNS spoofing that could make calls to https://api.domain.com go to a malicious IP address instead of the real one?

Improve this question

1 Answer 1

Reset to default
2

Yes you can put IP addresses in there as well. We've been doing this for years.

Do note that salesforce does a 1:1 comparison between the domain name used in the callout and the Remote Site Setting. So you will have to use the IP address in the callout as well (and not the literal domain name).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .