Whitelisting Smartcat domains and IP addresses for corporate firewalls

Overview

Some corporate firewalls, proxies, or web security gateways block traffic to Smartcat's notification emails or the main platform before a user or IT team explicitly allows it. This article lists the domains and IP ranges a client's IT team needs to whitelist to restore access.

📌 This is different from Smartcat's own IP addresses whitelist feature, which restricts who can log into a Smartcat workspace by IP. This article covers the opposite direction: what a client's network needs to allow outbound so their users can reach Smartcat.

When to use it

• A prospect or client reports that Smartcat notification/invitation emails, or links inside them, are being blocked

• A trial sign-up or the main Smartcat platform is blocked by a corporate firewall, proxy, or web security gateway

• A client's IT team asks what IP address or user agent Smartcat uses to connect

What problem do you actually have?

Mail delivery issues with Smartcat generally fall into one of two distinct categories, and they require different fixes. Check which one applies before making any changes:

If you're not sure which applies, the key question is: does the email appear to come from a Smartcat domain (http://smartcat.com/), (http://smartcat.ai/), (http://sc-notification.ai/), or from your own company's domain? If it's a Smartcat domain, you have Problem 1. If it's your own domain, you have Problem 2.

What to whitelist

Domain-based whitelisting. This is the most durable option because it survives IP changes on Smartcat's side.

• sc-notification.ai (ideally as a wildcard, *.sc-notification.ai) — Smartcat sends notification and invitation emails from this domain

• smartcat.com and smartcat.ai — the destination platform domains, or the specific regional subdomain the workspace is hosted on (for example eu.smartcat.com or us.smartcat.com)

Authenticating your domain for Smartcat-sent email (branded portal / custom sender)

If Smartcat is sending email on your behalf that shows your own domain as the sender — for example, a branded Client Portal, a custom invoice or notification template, or a customer-managed SMTP relay — that mail must pass your domain's own SPF/DKIM/DMARC alignment checks. Without proper authentication, receiving mail servers (including your own, if you enforce DMARC) may quarantine or silently drop it as a spoofing attempt.

What to do:

1. Confirm with your Smartcat representative that your account is configured for domain authentication (this applies only if you're using a custom "From" domain — most customers are not, and can skip this section entirely).

2. Smartcat's sending infrastructure generates a set of account-specific CNAME records through its domain authentication process — these are unique to your account and domain, so there is no fixed, universal list of records to add in advance.

3. Once generated, add the provided CNAME records to your own domain's DNS.

4. Allow for DNS propagation (typically up to 24-48 hours) before verifying authentication status with your Smartcat representative.

Important: skipping this step is a common cause of mail being quarantined by strict anti-spoofing validation (e.g. Valimail, DMARC enforcement) at either your own organization or your recipients' organizations, since the mail will otherwise fail alignment checks for your domain.

If you're seeing intermittent delivery failures specifically for a branded portal or custom-sender setup, and you're unsure whether domain authentication has been completed for your account, contact your Smartcat representative to confirm.

Requirements and limitations

• Smartcat does not have a single set of static outbound IPs for general email/web traffic — addresses are drawn from an AWS pool, which is why domain-based whitelisting is preferred over IP-based whitelisting where the client's firewall supports it

• IP-based whitelisting must be entered as continuous ranges (CIDR notation); entering individual IPs one at a time is possible but slower to set up and more likely to require updates later

FAQs

Our IT team can only enter individual IP addresses, not ranges. What do we give them?

Ask them to expand the CIDR ranges above into individual addresses if their tooling requires it, but flag that this is more fragile — Smartcat's outbound IPs rotate within these AWS ranges over time.