Overview
If your organization uses a firewall, web filter, or other network security tools, your IT team may need to allowlist specific BombBomb domains and IP ranges to ensure full functionality — including email sending, video recording, screen capture, and engagement tracking.
This article lists all domains that should be added to your allowlist. Share it with your IT or network security team.
Who this applies to: IT administrators configuring network security for BombBomb users
Plan requirement: Core, Core + Copilot, Enterprise
Quick Allowlist (Recommended)
To avoid any service interruptions, allowlist the following wildcard domains. This is the fastest way to cover all BombBomb services at once.
*.bombbomb.io *.bombbomb.com *.aptrinsic.com effectssdk.com *.bixel.io bixel*.net quaxel*.net 1x1.bbsv*.net mail.bbsv*.net p-3c15285d-videos.s3.amazonaws.com p-3c15285d-videos.s3-accelerate.amazonaws.com *.sentry.io
If your security policy does not allow wildcard entries, use the granular lists below to allowlist only what each service requires.
Email Tracking
BombBomb's tracking features — email opens, link clicks, and engagement analytics — rely on the following domains. These are used by the Gmail Chrome Extension, Outlook Add-in, and other integrations.
bb.bixel.io bixel1.net bixel2.net bixel3.net bixel4.net bixel5.net bixel6.net bixel7.net bixel8.net bixel9.net bixel10.net quaxel1.net quaxel2.net quaxel3.net quaxel4.net quaxel5.net quaxel6.net
Video Recording
BombBomb's video recorder stores and processes video through the following endpoints. All must be accessible for recording and uploading to function correctly.
video.bombbomb.io p-3c15285d-videos.s3.amazonaws.com p-3c15285d-videos.s3-accelerate.amazonaws.com effectssdk.com static.bombbomb.com metro.bombbomb.io lumberjack.bombbomb.io *.ingest.sentry.io
Screen Recording
The BombBomb screen recorder requires the following domains for installation, capture, and upload. Note that wss:// indicates a secure WebSocket connection required for real-time screen capture.
wss://video.bombbomb.io video.bombbomb.io desktop.bombbomb.io s3.amazonaws.com/bombbomb-installers/BombBombInstaller.exe p-3c15285d-videos.s3.amazonaws.com p-3c15285d-videos.s3-accelerate.amazonaws.com effectssdk.com static.bombbomb.com metro.bombbomb.io lumberjack.bombbomb.io
Frequently Asked Questions
Should we use the Quick Allowlist or the granular lists? If your security policy permits wildcard entries, use the Quick Allowlist — it's simpler to maintain and ensures full coverage if BombBomb adds new subdomains. Use the granular lists only if your policy requires explicit domain-by-domain entries.
Our users can record video but tracking isn't working. What should we check? Email tracking uses a separate set of domains from video recording. Make sure the Email Tracking domains (bixel*.net, quaxel*.net) are allowlisted in addition to the video domains.
The screen recorder installs but doesn't capture or upload correctly. What's missing? Confirm that both wss://video.bombbomb.io (WebSocket) and the S3 domains are allowlisted. Blocking WebSocket connections is a common cause of screen capture failures.