Canvas Domain, Email, and Server Management
This document lists the domains and IP addresses used in various areas of Canvas.
Many K12 schools and some higher education institutions need to restrict the websites that students can visit while on campus and want to manage Canvas’ resources.
Future changes may require additional configurations. Institutions that use Canvas domain, email, or server resource management should thoroughly test their firewalls to avoid instability.
Canvas Core Domains
Whenever possible, Canvas uses a subdomain of <domain>.instructure.com to host additional resources. This behavior allows institutions to allow *.instructure.com and cover a range of services that Canvas provides.
Some of the built-in functionality of Canvas is accessed via a separate URL that will also need to be allowed:
Browser Security
- *.canvas-user-content.com
Canvas Guides
- *.canvaslms.com
Canvas Images/File Storage (except Media)
- *.inscloudgate.net/
- instructure-uploads.s3.amazonaws.com
- instructure-uploads-2.s3.amazonaws.com
- instructure-uploads-eu.s3.amazonaws.com
- instructure-uploads-apse1.s3.amazonaws.com
- instructure-uploads-apse2.s3.amazonaws.com
- instructure-uploads-fra.s3.amazonaws.com
- instructure-uploads-pdx.s3.amazonaws.com
- Instructure-uploads-yul.s3.amazonaws.com
Canvas Media Storage
- *.instructuremedia.com
- notorious-prod.s3.amazonaws.com
- notorious-prod-apse1.s3.amazonaws.com
- notorious-prod-apse2.s3.amazonaws.com
- notorious-prod-eu.s3.amazonaws.com
- notorious-prod-fra.s3.amazonaws.com
- notorious-prod-pdx.s3.amazonaws.com
- notorious-prod-yul.s3.amazonaws.com
Conferences - BigBlueButton basic integration
- *.blindsidenetworks.com
DocViewer
- canvadocs.instructure.com
Gravatar Images (Profile Pictures)
- *.gravatar.com
Office 365 Integration
- office365-iad-prod.instructure.com
Google Docs Integration
- docs.google.com
Google Drive Integration
- drive.google.com
Import Scripts and Canvas Resources
- *.cloudfront.net
Rich Content Editor Math Equations
- instructure.codecogs.com
Support Help
- *.canvaslms.com
Quizzes and Outcomes Domains
Quizzes and Outcomes URLs follow a similar pattern to Canvas URLs with the addition of the Amazon Web Services (AWS) region (IAD, PDX, YUL, DUB, FRA, SYD, SIN). Also, Quizzes has two application URLs instead of just one.
For institutions unsure about which region to use for an account, please contact Canvas Support or a Customer Success Manager.
- kinesis.*.amazonaws.com
- *.cloudfront.net
- *.learnosity.com
- *.quiz-api-<region>-prod.instructure.com
- *.quiz-lti-<region>-prod.instructure.com
- *.quiz-api-<region>-beta.instructure.com
- *.quiz-lti-<region>-beta.instructure.com
- *.outcomes-<region>-prod.instructure.com
Email Notification IP Addresses
SMTP allows any computer to send email claiming to be from any source address. Spammers and phishing often use this to forge email addresses, making it more difficult to trace a message back to its sender and easy for spammers to hide their identity in order to avoid responsibility; they even dupe users into disclosing private information in response to an email.
Verification Systems
Canvas uses SPF, which is an email validation system designed to prevent email SPAM and phishing by detecting and preventing email spoofing. SPF allows administrators to specify which hosts (IP addresses, computers) are allowed to send mail from a given domain by creating specific SPF records in the DNS. Mail exchangers then use the DNS to verify mail from a given domain is being sent by a sanctioned host.
Canvas also uses DomainKeys Identified Mail (DKIM) to sign mail. DKIM associates our domain name to an email message, thereby allowing Canvas to claim responsibility for the message (sign the message). The digital signature is validated by recipient. Responsibility is claimed by a signer (instructure.com), independently of the message's actual authors or recipients, by adding a DKIM-Signature: field to the message's header. The verifier recovers the signer's public key using the DNS, and then verifies that the signature matches the actual message's content.
If customers cannot receive email notifications from Canvas, emails are typically being sent to the Spam folder. To correct this behavior, update spam settings to allow emails from instructure.com.
Email IP Addresses
If needed, institutions can allow all static Canvas Email IP addresses.
When Email IP addresses are allowlisted, the entire list of IP addresses should be allowlisted. The variety of IP addresses ensure a specific IP is not overloaded and activity can be distributed across various data centers as needed. This recommendation also applies to adding international IP addresses as well.
Note: The IP list may be updated at any time.
Customers hosted in Canada
99.79.19.152
52.60.179.121
23.249.209.14
23.249.209.15
Customers hosted in Ireland (DUB) or Frankfurt (FRA)
54.240.89.126
54.240.89.127
54.240.89.128
54.240.89.129
54.240.89.130
Customers hosted in Singapore (SIN) or Sydney (SYD)
69.169.235.184
69.169.235.186
69.169.235.185
Customers hosted in Virginia (IAD) or Oregon (PDX)
23.249.221.108
23.249.221.109
23.249.221.110
23.249.221.111
23.249.221.112
23.249.221.113
23.249.221.114
23.249.221.115
23.249.221.116
23.249.221.117
23.249.221.118
23.249.221.119
23.249.221.120
23.249.221.121
23.249.221.122
23.249.221.123
23.249.221.124
23.249.221.125
23.249.221.126
23.249.221.127
54.240.127.59
54.240.127.60
54.240.127.61
54.240.127.62
54.240.127.63
54.240.127.64
54.240.127.65
54.240.127.66
54.240.127.67
54.240.127.68
54.240.14.1
54.240.14.100
54.240.14.102
54.240.14.103
54.240.14.105
54.240.14.107
54.240.14.128
54.240.14.130
54.240.14.131
54.240.14.139
54.240.14.154
54.240.14.188
54.240.14.198
54.240.14.199
54.240.14.2
54.240.38.184
54.240.38.185
54.240.38.186
54.240.38.187
54.240.38.188
LDAP
Most LDAP servers are not publicly available and are protected by firewalls. Canvas admins can create an allowed list of firewall exceptions to connect to their LDAP server. Canvas designates a set of servers and their associated static IP addresses to simplify these firewall exception rules.
For institutions unsure about which region to use for an account, please contact Canvas Support or a Customer Success Manager.
Note: The IP list may be updated at any time.
CANADA
52.60.71.96 prod ca-central-1a
52.60.54.125 prod ca-central-1b
52.60.193.95 nonprod ca-central-1a
52.60.42.222 nonprod ca-central-1b
FRANKFURT
52.29.85.26 = nat1 (prod) eu-central-1a
52.29.84.246 = nat2 (prod) eu-central-1b
18.185.69.114 = nat3 (prod) eu-central-1c
52.29.95.79 = nat1 (nonprod) eu-central-1a
52.29.119.13 = nat2 (nonprod) eu-central-1b
18.184.239.128 = nat3 (nonprod) eu-central-1c
IRELAND
46.51.199.181 = nat1-a (prod) eu-west-1a
46.51.199.184 = nat1-b (prod) eu-west-1b
46.51.199.187 = nat1-c (prod) eu-west-1c
54.229.62.101 = nat1 (nonprod) eu-west-1a
54.229.61.11 = nat2 (nonprod) eu-west-1b
54.229.62.136 = nat3 (nonprod) eu-west-1c
OREGON
50.112.155.19 = nat1 (prod) us-west-2a
50.112.155.17 = nat2 (prod) us-west-2b
50.112.138.16 = nat3 (prod) us-west-2c
34.212.202.226 = nat1 (nonprod) us-west-2a
54.70.178.34 = nat2 (nonprod) us-west-2b
34.210.5.133 = nat3 (nonprod) us-west-2c
SINGAPORE
54.255.173.119 = nat1 (prod) ap-southeast-1a
54.255.173.249 = nat2 (prod) ap-southeast-1b
52.74.23.74 = nat3 (prod) ap-southeast-1c
54.255.177.29 = nat1 (nonprod) ap-southeast-1a
52.77.73.203 = nat2 (nonprod) ap-southeast-1b
54.179.60.151 = nat3 (nonprod) ap-southeast-1c
SYDNEY
54.79.101.198 = nat1 (prod) ap-southeast-2a
54.79.104.239 = nat2 (prod) ap-southeast-2b
54.206.13.66 = nat3 (prod) ap-southeast-2c
54.79.80.35 = nat1 (nonprod) ap-southeast-2a
13.55.54.243 = nat2 (nonprod) ap-southeast-2b
54.66.224.5 = nat3 (nonprod) ap-southeast-2c
VIRGINIA
184.72.117.210 = nat1-b (canvasprod) us-east-1b
107.23.48.136 = nat1-c (canvasprod) us-east-1c
107.23.49.116 = nat1-e (canvasprod) us-east-1e
107.21.12.41 = nat1 (test/beta) us-east-1
54.208.19.142 = nat1 (futureprod) us-east-1b
54.208.31.242 = nat2 (futureprod) us-east-1c
54.208.28.84 = nat3 (futureprod) us-east-1e
54.208.2.214 = nat1 (futurenonprod) us-east-1b
54.208.5.44 = nat2 (futurenonprod) us-east-1c
54.208.27.95 = nat3 (futurenonprod) us-east-1e
SHARED SFTP (PDX)
52.41.151.176 us-west-2a
35.164.144.191 us-west-2b
54.71.241.59 us-west-2c
Last update: 2024-03-19
