Salesforce IP Ranges
Salesforce runs AS14340, registered with ARIN to Salesforce.com, Inc., but that network is only part of the picture: its own published feed labels a large share of its ranges as sitting inside other companies' clouds.
- Provider
- Salesforce
- Primary ASN
- AS14340
- Category
- Tech
- Headquarters
- San Francisco, CA, USA
- Announced IPv4 prefixes
- 40
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS14340 (SALESFORCE - Salesforce.com, Inc.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
13.108.0.0/15
160.8.0.0/16
136.147.0.0/16
13.111.0.0/16
13.110.0.0/16
136.146.0.0/16
159.92.0.0/16
128.245.0.0/16
128.17.0.0/16
163.79.128.0/17
2605:6180::/32
2a03:5d60::/32
2401:ce80::/32 (IPv6)
What does a Salesforce IP mean in a privacy test?
A Salesforce address usually means an integration rather than a person: outbound callouts, single sign-on and API traffic from a Salesforce org reach you from Salesforce's space rather than from a user's browser. Checking one against AS14340 alone is not enough, because the ranges Salesforce publishes include blocks that sit in Amazon and Google space.
Where Salesforce publishes its IP ranges
Salesforce publishes a single JSON feed at ip-ranges.salesforce.com/ip-ranges.json, built the way AWS builds its own: a syncToken and a createDate at the top, then a prefixes array and an ipv6_prefixes array. Each entry names a region, a provider and the blocks themselves, so one of them reads region us-east-1, provider aws, prefixes 155.226.144.0/22 and 155.226.137.0/24. The token and the date are what make it pollable: a rule builder can compare them and skip the parse when nothing has moved.
The company is direct about the limits of the exercise. Its allowlist article states that Salesforce does not offer static IP addresses or small ranges for individual instances, and that the best practice is to allow the entire published set rather than the part you think applies to you. In July 2026 the separately published Edge addresses were folded into this same list. For Hyperforce, Salesforce recommends mutual TLS in preference to IP allowlisting, on the grounds that cloud addressing moves.
Why a Salesforce address may not look like Salesforce
This is the network where a registry lookup is most likely to mislead. The published feed labels every block with the provider it sits in, and many of them read aws or gcp - space a WHOIS lookup attributes to Amazon or Google rather than to Salesforce. An address that resolves to a cloud provider therefore does not rule Salesforce out, and that is precisely the case the feed exists to settle: match against the file, not against the ASN.
The other direction is cleaner. AS14340 is Salesforce's own network and is not leased to customers, so an address there is Salesforce infrastructure rather than a machine belonging to one of the organisations that use it. Neither answer tells you which customer org made the call, because the addresses are shared across tenants - an allowlist here is a way to admit Salesforce, not a way to identify who is behind it.
Related tools
Frequently asked questions
What IP ranges does Salesforce use?
Salesforce publishes them as JSON at ip-ranges.salesforce.com/ip-ranges.json, grouped by region and by the provider each block sits in. Its own network is AS14340, registered with ARIN to Salesforce.com, Inc., and the blocks above are the largest currently routed there; the feed additionally covers space inside the Amazon and Google clouds.
Why does a Salesforce IP appear in my privacy test?
A Salesforce address usually means an integration rather than a person: outbound callouts, single sign-on and API traffic from a Salesforce org reach you from Salesforce's space rather than from a user's browser. Checking one against AS14340 alone is not enough, because the ranges Salesforce publishes include blocks that sit in Amazon and Google space.
Does Salesforce give an org its own static IP address?
No. Salesforce's allowlist article states that it does not offer static IP addresses or small ranges of IP addresses for individual instances, and recommends allowing the entire published set. For Hyperforce it recommends mutual TLS instead of IP allowlisting.
Why does a Salesforce address look like an AWS address?
Because a large part of the published set is exactly that. Each entry in the feed names the provider it belongs to and many read aws or gcp, so a registry lookup attributes the address to Amazon or Google while Salesforce is the party using it.
How do I keep a Salesforce allowlist current?
Poll the JSON feed and compare its syncToken and createDate against the copy you last processed - those fields exist so a rule builder can tell a changed file from an unchanged one. Salesforce also moved its Edge addresses into this list in July 2026, so a rule written against the older separate list is now incomplete.