Salesforce Now Recognizes QuotaGuard Static IPs

After roughly two months of working through this with Heroku, Salesforce, and affected customers, we finally have the resolution we were looking for.

Salesforce has whitelisted QuotaGuard's static IP addresses.

We also have confirmation from customers using QuotaGuard successfully in production following the change.

This resolves a particularly strange problem that started appearing after Salesforce's May 11, 2026 OAuth security changes. AppExchange ISVs were adding static outbound IPs to comply with Salesforce's Refresh Token IP Allowlist requirements, only to have some of those connections classified by Salesforce as anonymizing proxy traffic.

In the cases we investigated, that classification could cause Salesforce to freeze a user and revoke OAuth access and refresh tokens.

What Was Happening

The basic sequence was:

1. A Salesforce ISV needed a stable outbound IP for its External Client App.
2. The application routed its Salesforce OAuth traffic through QuotaGuard.
3. The QuotaGuard addresses were added to Salesforce's Refresh Token IP Allowlist.
4. Salesforce's security systems separately identified some of that traffic as coming from an anonymizing proxy.
5. The resulting security response could freeze the Salesforce user and revoke OAuth tokens.

We initially thought this might be a reputation issue affecting a particular shared proxy address.

We moved one affected customer to a pair of dedicated QuotaGuard IPs carrying only that customer's traffic. Salesforce eventually classified one of those dedicated IPs the same way.

That was the important data point. This was not simply a shared-IP reputation problem that we could solve customer by customer with dedicated infrastructure.

Salesforce Reviewed the QuotaGuard IP List

We escalated the issue through Heroku because these were Heroku customers using QuotaGuard to provide the static outbound networking that their Salesforce integrations required.

Salesforce ultimately reviewed the QuotaGuard IP addresses and whitelisted them.

That changes the problem at the reputation layer rather than requiring every affected Salesforce org to request its own exemption.

You Still Need to Register Both QuotaGuard Addresses

The Salesforce whitelist does not replace the Refresh Token IP Allowlist configuration required for your External Client App.

Every QuotaGuard subscription includes two static IP addresses as a load-balanced pair. Traffic may egress from either address depending on health and availability, so both addresses need to be registered with Salesforce.

QuotaGuard addresses are individual /32 host addresses rather than CIDR ranges. When Salesforce asks for a start and end address, enter the same IP as both values.

You can confirm the address Salesforce will see by making a request through QuotaGuard from the same environment running your integration:

curl -x $QUOTAGUARDSTATIC_URL https://ip.quotaguard.com

A typical QuotaGuard connection URL looks like:

QUOTAGUARDSTATIC_URL=http://username:password@<your-quotaguard-proxy-host>:9293

Register both resulting static IPs in the Refresh Token IP Allowlist for your External Client App.

If Salesforce Already Froze an Account

The whitelist prevents the QuotaGuard addresses from being treated as anonymizing proxy infrastructure going forward. It does not automatically undo containment actions Salesforce already performed.

If a Salesforce user was already frozen, the Salesforce org administrator will still need to unfreeze the user. Because Salesforce may have revoked the application's OAuth refresh tokens during the security event, the integration may also need to be authorized again.

Why This Matters for AppExchange ISVs

The problem was particularly difficult for ISVs because one integration can authenticate against many independent Salesforce customer orgs.

A networking change that triggers security controls is not confined to one Salesforce environment. The same infrastructure change can appear simultaneously across development orgs, sandboxes, production orgs, and customer installations.

That is why we pushed for a central Salesforce-side resolution instead of treating each affected customer as a separate support case.

It took roughly two months to get from the first customer reports and escalations to confirmation that the addresses had been whitelisted. The important part is that we now have a central resolution rather than another customer-by-customer workaround.

QuotaGuard and Salesforce

QuotaGuard provides a pair of static inbound and outbound IP addresses for applications running on Heroku and other cloud platforms.

For Salesforce integrations, the important piece is stable outbound egress. OAuth token exchanges and API requests can consistently originate from the same two addresses, which can then be registered with Salesforce.

QuotaGuard Static starts at $19/month. QuotaGuard Shield is available for applications that require encrypted connectivity to the proxy and SSL passthrough.

See QuotaGuard Static plans and pricing, read our full technical explanation of the Salesforce anonymizing-proxy issue, or contact us if you are deploying a Salesforce integration across multiple customer orgs.