Channel static IP addresses
When a channel endpoint connects out to a server you or your trading partner operate - delivering a routed file, or polling a server for new files - the connection comes from a small, fixed set of IP addresses in the channel's region. If that server sits behind a firewall that only accepts connections from known addresses, allowlist the addresses below.
Looking for the Simple FTP Service addresses instead - the ones your users connect to for FTP, FTPS and SFTP? Those are at SFS Static IP addresses and ports.
The addresses
Channels run in the region you created your channel in. A connection can come from any of that region's addresses, so allowlist the full list - not just the one you see connecting today.
| US East (N. Virginia) - us-east-1 | Europe (Ireland) - eu-west-1 |
|---|---|
| 18.208.17.116 | 34.248.85.53 |
| 34.207.41.151 | 34.247.95.209 |
| 54.242.116.100 | 54.76.239.74 |
| 44.219.138.165 | 52.209.110.50 |
| 54.85.142.6 | 40.180.156.215 |
These addresses are static and permanent. If we ever add addresses to a region (or add a new channel region), we will announce it in News before any traffic uses them - addresses are never removed from this list.
Which endpoints this applies to
Allowlisting matters wherever DocEvent initiates the connection to infrastructure you control:
- FTP Push and SFTP Push destinations - deliveries to your FTP(S)/SFTP server connect from these addresses.
- FTP Pull and SFTP Pull sources - the scheduled polls of your server connect from these addresses.
- HTTP destinations - the POST to your endpoint comes from these addresses.
- AS2 - outbound AS2 messages to a partner's endpoint, and the asynchronous MDN receipts DocEvent posts back for inbound messages, come from these addresses. Give this list to any trading partner who firewalls their AS2 server.
- Cloud storage endpoints (Amazon S3 and S3-compatible, Google Cloud Storage, Azure, SharePoint) - these normally need no allowlisting, but if you restrict a bucket or storage account by source IP, the requests also come from these addresses.
Email destinations are the exception: channel emails are sent through Amazon SES, not from these addresses. Use SPF/DKIM validation rather than IP allowlisting for email.
What this does not cover
Files sent to DocEvent - an upload to an HTTP receive endpoint, or a partner posting AS2 messages to your receive endpoint's URL - arrive at per-region ingress hostnames that are separate from the egress addresses above. Your partner does not need any IP list to send to DocEvent; the addresses on this page are only where DocEvent connects from.