--- title: Introducing IP Allowlisting | daily.dev description: Postmark launched IP Allowlisting, a free security feature available on all plans that restricts which IPs can send email through the Postmark API. You add up... canonical: https://daily.dev/posts/introducing-ip-allowlisting-kekbyxmth twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing IP Allowlisting | daily.dev og:description: Postmark launched IP Allowlisting, a free security feature available on all plans that restricts which IPs can send email through the Postmark API. You add up... og:url: https://daily.dev/posts/introducing-ip-allowlisting-kekbyxmth og:image: https://api.daily.dev/og/posts/KEkByXMtH.png og:image:alt: Introducing IP Allowlisting og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing IP Allowlisting **[Postmark](https://daily.dev/sources/postmark)** · 6 min read · 0 upvotes · 0 comments ## Summary Postmark launched IP Allowlisting, a free security feature available on all plans that restricts which IPs can send email through the Postmark API. You add up to 10 CIDR ranges either on a Server or across your account, and requests from outside those ranges get rejected with a 403 status naming the offending IP. It's off by default until enabled, only applies to API email-sending endpoints (not SMTP), and is managed only through the UI, not the API. Postmark recommends starting with wide ranges on a test Server before narrowing and enabling at the account level. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Postmark's IP allowlisting feature work? It lets you specify up to 10 IP ranges in CIDR format that are allowed to send email through the Postmark API, set either per Server or account-wide. Requests from outside those ranges get rejected with a 403 status code that includes the detected IP. It's free on all plans and off by default until enabled, and it only applies to API sending endpoints, not SMTP. _Teams locking down transactional email APIs can track security feature rollouts like this on daily.dev._ ### Does IP allowlisting in Postmark affect which IP my emails are delivered from? No, it only controls which IPs can submit send requests to the Postmark API; it has no effect on the sending IP used for delivery, reputation, or warmup. Dedicated and shared IPs govern the address your email is sent from, while IP allowlisting governs the address your API requests arrive from, a separate concept despite both involving 'IP'. _Developers weighing dedicated versus shared IP setups can follow email infrastructure changes via daily.dev._ ### How do I enable an IP allowlist without accidentally blocking my own email sending? Start with wider CIDR ranges than you think you need, since an overly narrow range can block your own sending, and test the ranges on a Server you don't depend on before applying them account-wide. Send to that test Server from your production environment first; if a request is rejected, the 403 response names the missed IP so you can correct it before turning the allowlist on broadly. _Anyone rolling out new access controls can check rollout guidance like this through daily.dev._ ## Similar posts on daily.dev - [Self-hosting email the hard way from your own routable IPv4 block up](https://daily.dev/posts/self-hosting-email-the-hard-way-from-your-own-routable-ipv4-block-up-wjyagn4e7) · Lobsters · 0 upvotes · 0 comments - [A new allowlists design for Grafana Cloud IP addresses: What you need to know](https://daily.dev/posts/a-new-allowlists-design-for-grafana-cloud-ip-addresses-what-you-need-to-know-bucsljwkb) · Grafana Labs · 1 upvotes · 0 comments - [IP Blacklist Check: How to Recover and Prevent Blacklisted IP Addresses](https://daily.dev/posts/ip-blacklist-check-how-to-recover-and-prevent-blacklisted-ip-addresses-jstihzhgh) · Security Boulevard · 0 upvotes · 0 comments - [Why Email Domain Restrictions Alone Won’t Protect Your Marketing Forms](https://daily.dev/posts/why-email-domain-restrictions-alone-won-t-protect-your-marketing-forms-n4dy3fcbe) · Arcjet · 1 upvotes · 0 comments - [Protected Quick Tunnels: simple accountless authentication for your next dev project](https://daily.dev/posts/protected-quick-tunnels-simple-accountless-authentication-for-your-next-dev-project-1zufe0ysm) · Cloudflare · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/introducing-ip-allowlisting-kekbyxmth) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing IP Allowlisting","url":"https://daily.dev/posts/introducing-ip-allowlisting-kekbyxmth","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-ip-allowlisting-kekbyxmth"},"datePublished":"2026-10-26T15:20:58.989Z","dateModified":"2026-10-26T15:21:32.571Z","description":"Postmark launched IP Allowlisting, a free security feature available on all plans that restricts which IPs can send email through the Postmark API. You add up...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/23b653da8c375af2277c4075acb8f95a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/23b653da8c375af2277c4075acb8f95a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Postmark","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Postmark","logo":"https://media.daily.dev/image/upload/s--5RIgLa6b--/f_auto,pg_1/v1793028046/squads/c325f08d-1d81-46ad-b362-01c57fae4a75?_a=BAMAMiiw0","url":"https://daily.dev/squads/postmark"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-ip-allowlisting-kekbyxmth","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Postmark","item":"https://daily.dev/squads/postmark"},{"@type":"ListItem","position":3,"name":"Introducing IP Allowlisting"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-ip-allowlisting-kekbyxmth#faq","mainEntity":[{"@type":"Question","name":"How does Postmark's IP allowlisting feature work?","acceptedAnswer":{"@type":"Answer","text":"It lets you specify up to 10 IP ranges in CIDR format that are allowed to send email through the Postmark API, set either per Server or account-wide. Requests from outside those ranges get rejected with a 403 status code that includes the detected IP. It's free on all plans and off by default until enabled, and it only applies to API sending endpoints, not SMTP. Teams locking down transactional email APIs can track security feature rollouts like this on daily.dev."}},{"@type":"Question","name":"Does IP allowlisting in Postmark affect which IP my emails are delivered from?","acceptedAnswer":{"@type":"Answer","text":"No, it only controls which IPs can submit send requests to the Postmark API; it has no effect on the sending IP used for delivery, reputation, or warmup. Dedicated and shared IPs govern the address your email is sent from, while IP allowlisting governs the address your API requests arrive from, a separate concept despite both involving 'IP'. Developers weighing dedicated versus shared IP setups can follow email infrastructure changes via daily.dev."}},{"@type":"Question","name":"How do I enable an IP allowlist without accidentally blocking my own email sending?","acceptedAnswer":{"@type":"Answer","text":"Start with wider CIDR ranges than you think you need, since an overly narrow range can block your own sending, and test the ranges on a Server you don't depend on before applying them account-wide. Send to that test Server from your production environment first; if a request is rejected, the 403 response names the missed IP so you can correct it before turning the allowlist on broadly. Anyone rolling out new access controls can check rollout guidance like this through daily.dev."}}]} ```