# Introducing IP Allowlisting

DevFeed: [Introducing IP Allowlisting](<https://devfeed.tech/articles/introducing-ip-allowlisting-16082.md>)

Original publisher: [Read original article](<https://postmarkapp.com/blog/restrict-email-sending-api-with-ip-allowlisting>)

Author: Postmark team (fdossetto+postmark@activecampaign.com)

Published: 2026-09-08T17:37:00Z

Content type: release

Language: en

Sources: [Postmark (en-US)](<https://devfeed.tech/sources/postmark-en-us.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [API](<https://devfeed.tech/topics/api.md>), [Network](<https://devfeed.tech/topics/network.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [ip](<https://devfeed.tech/tags/ip.md>), [nat](<https://devfeed.tech/tags/nat.md>), [network](<https://devfeed.tech/tags/network.md>), [product-news](<https://devfeed.tech/tags/product-news.md>), [protection](<https://devfeed.tech/tags/protection.md>), [range](<https://devfeed.tech/tags/range.md>), [request](<https://devfeed.tech/tags/request.md>), [security](<https://devfeed.tech/tags/security.md>), [token](<https://devfeed.tech/tags/token.md>)

## AI overview

Postmark introduces IP Allowlisting, a security feature that restricts email sending through the Postmark API to up to 10 configured IP ranges in CIDR format. Requests from outside the allowed ranges are rejected with a 403 response. The ranges can be configured at the Server or account level, with Server settings overriding account settings.

## Source excerpt

Good security is layered and each layer does a job the others can't. Scoping a token to a Server limits what it reaches. Rotating a token limits how long it lasts. Neither can say anything about where a request came from. We've been hard at work to ship a new layer of protection that can. IP Allowlisting is a new Postmark security feature that lets you name the infrastructure your email should come from. It's available now on all Postmark plans at no extra cost. It's off until you turn it on. How IP Allowlisting works You add up to 10 IP ranges, in CIDR format, that are allowed to send email using the Postmark API. Send requests from outside those ranges are rejected with a 403 status code that includes the IP the request came from. You can set your ranges in two places: On a Server. The ranges apply to that Server, covering every Message Stream on it. This is where we'd suggest starting. On your account. The ranges apply to every Server you have. When a Server has ranges of its own they will override account level settings. That's it! A straightforward security control to protect your API sending. Protect individual Servers or across your account. Set your Allowlist ranges on the account or Server. If you don't write CIDR blocks often, it's a quick 30 seconds to get familiar with them and the correct notation. CIDR blocks allow you to enable a grouped collection of IP addresses (aka ranges.) A CIDR block is an IP address followed by a suffix that says how many addresses it covers. The smaller the suffix, the wider the range: 198.51.100.24/32 one address, and only that address 203.0.113.0/24 256 addresses: 203.0.113.0 through 203.0.113.255 203.0.0.0/16 65,536 addresses: 203.0.0.0 through 203.0.255.255 So a /32 pins the allowlist to a single machine, and a /24 covers a subnet. Most teams end up somewhere in that span. Where you find your own ranges depends on how you send. A single VM has a static public IP you can read off your provider's dashboard. Cloud workloads