Latest updates

Web API Company August 27, 2026

Secure API sending to trusted IPs with Allowlisting

We are releasing a new security setting in our UI called IP Allowlisting. Securing sending is essential when sending emails through Postmark. IP Allowlisting adds a new layer of protection for API sending. You define the IP ranges allowed to send email through the Postmark API and sending requests sent from outside those ranges are rejected with a 403 status code.

Show details

Here's how it works — You can add up to 10 IP ranges (in IPv4 CIDR format) that are allowed to send email using the Postmark API. Send requests originating from outside these ranges will be rejected with a 403 status code.

You can set this at two levels:

Account — applies to every email sent on your account.
Servers — applies to a single Server. When a Server has its own allowlist, it overrides the account-level setting for that Server. Otherwise, the account-level ranges apply.

A few things to know before you turn it on:

Allowlisting is designed to protect API sends. Please be aware that SMTP isn't checked against your ranges.
It's configured in the UI by design. Keeping allowlist changes out of the API adds another layer of control over who can touch your sending protections.
Allowlisting is not a Firewall/WAF replacement. It controls which IPs can send email through your account. It doesn't change or override any network-level security rules, and an IP on your allowlist can still be blocked by other security measures outside of Postmark's send path. Think of it as one specific control — who can send — not a general-purpose network shield.