Skip to main content

IP-Based Authentication

SMTP IP-Based Authentication

P
Written by Product Team
Updated over 2 weeks ago

How IP-Based Authentication Works

Unlike traditional SMTP authentication, which requires a valid email and password combination, IP relay validates the public IP address of the sender. If the IP is on a whitelist configured on the client's SMTP server (like Google Workspace), the email can be sent. This process doesn't involve the exchange of credentials, which simplifies configuration but shifts the responsibility for authentication and security to the network layer. While a STARTTLS negotiation is generally not required, some servers may still demand TLS.

Required Data for Connection

To enable SMTP IP Relay, you need to gather and configure the following information:

  • SMTP Host

  • Port: Typically 25, 587 (TLS), or 465 (SSL)

  • Allowed Address or Domain: Email addresses or domain names that Pipefy is authorized to send on behalf of the client

  • Client Domain: Used to define the correct HELO/EHLO domain or to configure the MAIL FROM envelope

  • Pipefy Domain: Used to define the correct HELO/EHLO domain or to configure the MAIL FROM envelope (app.pipefy.com)

  • IP Addresses: You will need to add Pipefy's IP addresses to your SMTP server's allow list (The service domain names and IPs used by Pipefy)

Configuration on Google Workspace

If you use Google Workspace, follow these steps to configure the SMTP relay for Pipefy:

  1. Access the Admin Console:

Go to Google Admin Console > Apps > Google Workspace > Gmail > Routing.

  1. Create or Edit the SMTP Relay Service:

    • Allowed senders: Choose one of the following options:

      • "Only addresses in my domains".

      • "Any address" (less secure, but more flexible).

    • Authentication: Select "Only accept emails from specific IP addresses" and add Pipefy's public IP addresses.

    • Optional settings: Enable TLS encryption and configure SPF/DKIM records if necessary.

  2. Save and Deploy: Ensure the changes propagate throughout your organization.

Microsoft 365 / Exchange Online

  1. Access the Microsoft 365 Admin Center:

Navigate to the Exchange Admin Center > Mail flow > Connectors.

  1. Create a New Connector:

Click the "+" button to add a new one.

Select "From your organization to Office 365" as the direction and "Partner" as the connection type.

  1. Configure IP Restrictions:

In the connection security section, choose "Restrict by IP address" and add Pipefy's IP addresses.

  1. Security Settings:

It is recommended to enable TLS. You also need to configure the domains this connector will process. Review and finalize the connector configuration.

SendGrid

  1. Configure in the SendGrid Dashboard:

Go to Settings > IP Access Management.

  1. Add IPs to the Allow List:

Add each of Pipefy's IP addresses (The service domain names and IPs used by Pipefy)

You can optionally add a description like "Pipefy SMTP Relay".

Amazon SES (Simple Email Service)

  1. Access the AWS Console:

Navigate to the SES service.

  1. Configure an IP Rule:

Under "SMTP Settings", select "IP Address Filters" and add Pipefy's IP addresses to the allow list (The service domain names and IPs used by Pipefy)

  1. Configure the Sending Policy:

Create or modify a sending policy to allow email relay from Pipefy's IPs.

  1. Verify Domains:

Ensure that the domains you will send emails from are verified in SES.

Advantages of IP-Based Authentication

  • Eliminates the need to store and manage SMTP credentials.

  • Simplifies the configuration process after the initial setup.

  • Adopts a widely used security standard for business email services.

Did this answer your question?