When initially setting up Marketing Cloud Connect, which IP addresses should be whitelisted?

• A. Whitelist the entire set of IP ranges for your region.
• B. Whitelist only a few IPs from your office.
• C. No IP whitelisting is required.
• D. Whitelist the public DNS only.

Answer: (A)

When Marketing Cloud Connect is set up, the integration traffic from Salesforce to Marketing Cloud travels through Marketing Cloud’s servers, which use a range of IP addresses. To keep that traffic flowing, you need to whitelist the entire set of Marketing Cloud IP ranges for your region. This coverage accounts for all endpoints Marketing Cloud may use now and as it grows, so connections aren’t blocked by IP changes.

Whitelisting only a few office IPs won’t suffice because users can access from different networks and Salesforce can route traffic through a variety of IPs. Not applying any IP whitelisting would leave the firewall open to unknown destinations, and whitelisting only the public DNS is unreliable since DNS resolves to IPs that can change and doesn’t provide deterministic control over the actual addresses being contacted.