Inbound and Outbound IP Addresses
Some organizations limit outbound communication to the Internet from internal resources for security purposes. This article discusses Zuora IP address whitelist, new Zuora IP addresses, and how to test connectivity. See Full Certification Chain for more information on Zuora's full certification chain for Production and API Sandbox.
Whitelist
A whitelist is a list of your trusted inbound and outbound connections. If your firewalls whitelist outbound connections, you will need to add the Zuora IP addresses to your whitelist.
Inbound IP Addresses to Zuora
As part of our ongoing commitment to ensure the highest availability and optimal security of Zuora services we leverage next-generation cloud technologies. Due to the dynamic nature of public cloud infrastructure, Zuora services are not hosted on a fixed set of IP Addresses. If you need to whitelist Zuora traffic, we recommend you use DNS based whitelisting for Zuora integrations.
IP Addresses to US Services Environments
DNS based whitelisting is preferred because the registered service name will stay the same when the service expands to use more IP addresses.
Please be advised that due to the dynamic nature of public cloud infrastructure that Zuora's Service Environments are deployed on we discourage our customers from implementing outbound whitelisting capability based on IP address restrictions. IP addresses are subject to change without advance notice as new server instances are created to handle the load.
Outbound IP Addresses from Zuora
When our application (from production or apisandbox) sends out an email or makes an outbound API call (for example, Paypal, Salesforce.com, or the callout/email notification feature), it comes from the following IP addresses.
- The US Cloud 1 environments are hosted in the US Cloud Data Center 1.
| US Cloud 1 Environment | IP Address |
|---|---|
|
Production |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
|
API Sandbox |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
|
Central Sandbox |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
- The US Cloud 2 environments are hosted in the US Cloud Data Center 2.
| US Environment | IP Address |
|---|---|
|
Production |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
|
API Sandbox |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
- The EU environments are hosted in the EU Cloud Data Center.
| EU Environment | IP Address |
|---|---|
| Production |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
| API Sandbox |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
| Central Sandbox |
In addition to the addresses listed above, the following IP addresses are effective starting from March 10, 2024:
|
-
The APAC environments are hosted in the APAC Cloud Data Center.
APAC Environment IP Address Production - 3.112.115.97
- 13.114.162.18
- 13.115.169.111
- 18.176.157.253
- 52.194.36.125
- 52.195.33.67
- 54.92.72.112
- 54.168.26.254
- 57.181.152.133
Central Sandbox - 3.113.190.237
- 13.113.9.203
- 13.114.115.194
- 13.115.169.111
- 35.78.13.235
- 35.78.51.82
- 35.79.84.158
- 43.206.7.163
- 52.68.251.193
- 52.199.220.136
- 54.64.13.254
- 54.150.243.141
- 54.168.26.254
- 54.250.99.99
It is important to Payment Gateways which IP Whitelist our traffic or customers who have to configure inbound firewall rules to all HTTPS notification calls from Zuora. Usually, there is no impact on the ability of customers to receive emails from Zuora application.
Inbound and Outbound IP Addresses for Collections, Workflow, Commerce, and Marketplace
If you want to receive emails, SFTP connection requests, or API calls from Zuora Collections, Zuora Workflow, Zuora Commerce, or Marketplace (formerly known as Connect), you need to add the following IP addresses to your whitelist:
- 3.66.181.151
- 3.72.120.178
- 3.72.209.33
- 4.71.24.46 (this IP address is for testing SFTP connections with bank servers)
- 18.194.185.125
- 18.197.110.107
- 34.218.15.157
- 35.155.216.3
- 35.156.120.222
- 52.26.252.153
- 52.33.107.0
- 52.35.247.230
- 52.37.233.34
- 52.39.100.104
- 52.40.19.141
- 52.89.135.4
- 54.68.23.116
- 54.71.138.87
In addition to the addresses listed above, the following IP addresses must be whitelisted for non-production environments:
- 3.65.51.43
- 3.66.144.234
- 18.196.118.61
- 18.196.79.49
- 18.198.47.111
- 35.161.181.38
- 44.226.112.161
- 44.232.2.249
- 50.112.203.250
- 52.37.16.34
- 13.115.169.111
- 54.168.26.254
In addition to the addresses listed above, the following IP addresses must be whitelisted for production environments:
- 3.66.144.234
- 3.72.192.189
- 3.124.7.222
- 18.193.237.5
- 18.198.47.111
- 35.155.99.130
- 35.161.181.38
- 44.230.234.43
- 50.112.203.250
- 54.70.147.75
- 13.115.169.111
- 54.168.26.254
Network Connectivity Tests
There are two tests required to validate connectivity:
| Test | Description |
|---|---|
| Network Connectivity Test | This test validates that application servers can communicate to TCP port 443 for all Zuora Akamai IP addresses listed above. |
| Certificate Verification Test | This test validates that the certificates were imported correctly and customer application’s can establish SSL connections based on the new EV SSL certificates. |
Test Network Connectivity
If you whitelist outbound communication, perform the following steps to verify that your systems can connect to all of the new Zuora servers.
-
Using a Windows or UNIX system, telnet to TCP port 443 on each IP address listed above.
-
If the telnet connection is successful to all IP addresses listed above, then connectivity has been verified.
-
If a connection cannot be established to any of the IP addresses listed above, then your network team must add those specific IP addresses to the whitelist.
Test the Certificate Import
- Identify the certificate store that your application uses.
-
Use the appropriate tool for your environment (keytool, openssl, Windows Certificate Manager, etc) and verify that the Root Certificate labeled “VeriSign Class 3 Public Primary Certification Authority - G5” exists in the store and is trusted.