Network Endpoints and IP Addresses – mxHero Help Center

This page lists the hostnames, ports and IP addresses your mail systems, firewalls and filters need in order to work with mxHERO. Give it to your network and email security teams before you change mail routing.

SMTP endpoints

Point your connectors, routes and relays at these hostnames. Don't use IP addresses for them.

Hostname	Ports	Use for
`smtp-in.mxhero.com`	25, 587	Mail coming in to your users: the inbound routing connector or route (loopback), or your MX record or border gateway (border)
`smtp-relay.mxhero.com`	25, 587	Mail your users send out: the outbound connector, route or smart host, and SMTP-Auth clients

Ports 25 and 587 behave the same on both hostnames. There is no port 465 (implicit TLS) listener.
Keep the two directions on separate connectors or routes. Sending inbound mail to smtp-relay.mxhero.com, or outbound mail to smtp-in.mxhero.com, is a common cause of loops and misrouted mail.

Important: Older mxHERO instructions referred to smtp.mxhero.com. Use smtp-in.mxhero.com for inbound and smtp-relay.mxhero.com for outbound. If your MX record or a connector still points to smtp.mxhero.com, contact mxHERO support before you change it.

SMTP-Auth clients

Devices and applications that can't use your mail platform's connectors, such as scanners or line-of-business apps, can send through mxHERO with SMTP authentication. Create the credentials in Settings › Gateway (up to 2 per organization), and connect to smtp-relay.mxhero.com. Supported mechanisms are PLAIN, LOGIN and CRAM-MD5. See Gateway settings.

mxHERO IP addresses

mxHERO connects to your mail servers, and to recipients' mail servers, from these addresses:

54.208.111.28
54.236.184.32
54.165.252.128
54.165.253.193
3.211.77.148
52.22.51.97
54.209.222.83
107.23.152.206

Add them wherever your systems decide whether to trust mail from mxHERO:

System	Where to add the IP addresses
Microsoft 365	The inbound partner connector mxHERO Tenant Connector (sender IP addresses), and the IP Allow List of the Default connection filter policy. The Office 365 Configuration Service adds both for you.
Google Workspace	Gmail › Spam, phishing and malware › Inbound gateway (gateway IPs), and the SMTP relay service rule if you use outbound loopback
Border gateway or on-premises server	The allow list or relay permissions for the host in your domain's Server or Relay Server field. Open the port you entered in that field (25 by default) to these addresses.
SPF	Don't list the IP addresses. Add `include:_spf.mxhero.com` instead. See SPF, DKIM and DMARC.

mxHERO announces changes to this list in advance. Keep every place you added it up to date.

TLS

mxHERO uses opportunistic TLS for SMTP in both directions. It offers TLS on every connection it receives and uses TLS on every connection it makes whenever the other server supports it, so mail between mxHERO and modern mail platforms is encrypted. SSLv2, SSLv3 and weak ciphers are disabled.

If your policy requires that a route always uses TLS, enforce it on your side:

Microsoft 365: set Require TLS on the inbound partner connector and certificate validation on the outbound connectors. The Office 365 Configuration Service creates the connectors this way.
Google Workspace: select Require TLS delivery and Require CA signed certificate on the mxHERO routes, and Require TLS encryption on the SMTP relay service rule.
Other systems: set a TLS policy for the mxHERO hostnames on your mail server or gateway.

Web hostnames

Allow these hostnames through web proxies and filters. Recipients outside your organization need the recipient hostnames too; let partners know if they filter web traffic.

For administrators and employees

Hostname	Used for
`dashboard-v3.mxhero.com`	Admin Dashboard
`dashboard-api.mxhero.com`	Admin Dashboard back end, called by your browser. Also hosts the SAML sign-in endpoints.
`app.mxhero.com`	End User App, and links in hold, approval and malware notices
`status.mxhero.com`	Service status page
`mcp.mxhero.com`	mxMCP, for AI assistants and tools that search Mail2Cloud Advanced email
`mcp-login.mxhero.com`	mxMCP sign-in pages

For recipients of mxHERO Shares links

Hostname	Used for
`<your-subdomain>.mxherocloud.com`	Shared links and file downloads. `<your-subdomain>` is set in mxHERO Shares › Settings.
`auth.mxherocloud.com`	Sign-in page for links that need authentication
`api.mxherocloud.com`	Shares service for the US region, called by the recipient's browser
`api-jp.mxherocloud.com`	Shares service for the Japan region, called by the recipient's browser
`shares.mxherocloud.com`, `files.mxherocloud.com`	Older link formats. They still work and redirect to your subdomain.
`static.mxhero.com`	Error page shown when a link has expired or does not exist

Depending on the sign-in methods you allow, recipients also reach Microsoft (login.microsoftonline.com) or Google sign-in pages, and Office files are previewed through Microsoft's online viewer.

For link tracking and reports

Hostname	Used for
`services.mxhero.com`	Open-tracking images and tracked links in processed email, and the link that mutes tracking notifications
`tracking.mxhero.com`	The Open tracking report link in tracking notifications
`monthly-usage-summary.mxhero.com`	The "Open in your browser" link in the monthly usage report

If you block services.mxhero.com, tracked links in processed email stop working for your users. See Link tracking.

Email addresses mxHERO sends from

Allow these senders in your spam filters so that alerts, notices and sign-in codes arrive:

Sender	Sends
`noreply@mxhero.com`	Alert digests, monthly usage report, blocked-message and bounce notices, tracking notifications, storage re-authorization requests, dashboard sign-in codes
`noreply@notifications.mxhero.com`	mxHERO Shares sign-in codes for recipients, and malware notices to file owners
`no-reply@mxhero.net`	mxMCP sign-in codes ("Your mxHERO sign-in code")

Forwarding Address rules use addresses at go.mail2cloud.io. Allow your mail system to send and copy mail to that domain.

Verify

From a server on your network, confirm you can open a connection to port 25 on smtp-in.mxhero.com and smtp-relay.mxhero.com. Many networks block outbound port 25 from workstations, so test from the mail server or gateway.
After routing is live, open a processed message's headers. You should see X-mxHero-Server and an ARC-Seal header with d=mxhero.com.
Open a mxHERO Shares link from outside your network to confirm the recipient hostnames aren't blocked.

Troubleshooting

Symptom	Cause	Fix
Messages from mxHERO are marked as spam or rejected	mxHERO IP addresses not in your allow lists, or SPF not updated	Add the IP addresses above. See Spam and authentication issues.
Your server rejects mail from mxHERO	The firewall or relay settings for the domain's Server don't allow mxHERO's IP addresses	Allow the IP addresses on the port in the Server field.
Recipients can't open mxHERO Shares links	A proxy or filter blocks `mxherocloud.com` hostnames	Allow the recipient hostnames above.
Mail loops between your system and mxHERO	Inbound and outbound hostnames swapped, or a route uses MX lookup that points back at your own system	Use `smtp-in` for inbound and `smtp-relay` for outbound, with explicit hosts. See Mail loops and bounces.