Email allowlist for LockRoom invites
For IT and security teams at firms invited into a LockRoom data room. What we send from, what to allowlist for email and the web, and how our mail is authenticated.
Allowlist the sender support@lockroom.com and the domains lockroom.com and send.lockroom.com, and require DKIM or SPF to pass. LockRoom sends through Resend on shared IP addresses, so allowlist by domain, not by IP.
What to allowlist
- Sender address:
support@lockroom.com. Data room invites and notifications come from this address. The display name is the name of the firm that sent the invite, not LockRoom, and replies go to that firm's room owner. - From domain:
lockroom.com - Return-Path (envelope sender) domain:
send.lockroom.com - DKIM: selector
resendonlockroom.com(key published atresend._domainkey.lockroom.com) - Sending service: Resend
The safest rule is a sender allow for lockroom.com that also requires DKIM or SPF to pass. An allow on the domain alone, with no authentication check, would also let spoofed mail through.
Why not IP addresses
LockRoom sends through Resend. Per Resend's documentation, all Resend senders use shared IP addresses by default, a pool shared across many senders, and Resend does not expose the IPs even in dedicated pools because those pools scale dynamically. There is no fixed IP list we can give you. Allowlist by domain and DKIM.
How our mail is authenticated
These records are public and you can check them with any DNS lookup.
- SPF for lockroom.com:
v=spf1 include:_spf.google.com include:amazonses.com ~all - SPF for send.lockroom.com:
v=spf1 include:amazonses.com ~all - DKIM: keys published at
resend._domainkey.lockroom.com(application mail) andgoogle._domainkey.lockroom.com(staff mail from Google Workspace) - DMARC for lockroom.com:
p=quarantine
Web access for the data room
Once the invite arrives, the data room opens in the browser. Allow HTTPS (port 443) to:
app.lockroom.com: the data room and the link in every inviteapi.lockroom.com: data, live updates (websockets) and watermarked document viewingd12q1fvmmcz1er.cloudfront.net: document viewing. Without it some documents may not open.lockroom-app-protected.s3.us-east-1.amazonaws.com: document downloads, signed NDA copies, and uploads. Without it downloads fail.lockroom.comandwww.lockroom.com: website and helplockroom-app.s3.us-east-1.amazonaws.com: firm logos in invite emails (optional)
Allow by hostname, not IP address; the addresses behind these hosts change. LockRoom is a virtual data room for M&A due diligence. If your web filter rates it as online storage, file sharing, or a parked domain, that rating is wrong: recategorize it locally as Finance or Business, or tell us at support@lockroom.com and we will take it up with the vendor.
Forward this to IT
Bankers: if a buyer's invite did not arrive, send them this.
I have been invited to a LockRoom data room and the invite may be held by our email filter.
Please allowlist support@lockroom.com and the domains lockroom.com and send.lockroom.com (DKIM selector resend), and allow HTTPS to app.lockroom.com, api.lockroom.com, d12q1fvmmcz1er.cloudfront.net and lockroom-app-protected.s3.us-east-1.amazonaws.com. Details: lockroom.com/help/email-allowlist
Still no invite?
- Check spam, junk, and your organization's quarantine for mail from support@lockroom.com.
- Once the allow rule is in place, ask the banker to resend the invite from the room. See how buyers are invited.
- Security questions beyond email: how secure LockRoom is.
- Anything else: email support@lockroom.com, or browse the LockRoom help index.