Which domains does MailMerge365 operate on and need to be whitelisted on firewalls?

As a campaign sender (user of MailMerge365):

The following domains are operated by MailMerge365 and used for the service:

• https://mailmerge365.com: the website
• https://app.mailmerge365.com: the application and Office plugin

It is not sufficient to whitelist just the IP addresses as our dynamic server scaling may result in changes to the IP addresses at any time (dynamic DNS).

In addition access to the Microsoft 365 (aka Office365) domains must be granted in order to authenticate with your Office365 account. Microsoft provides documentation on domains and IP addresses used for Office365.

As a campaign recipient (people you send MailMerge365 campaigns to):

The emails are sent via your own Microsoft 365 tenant (and therefore Microsoft's email sending infrastructure).

The tracking infrastructure users a variety of tracking urls (e.g. https://alink.re/xyz) that need to be reachable from your recipients computer via HTTPS. Both Outlook and their browser may open URLs on these domains if they receive an email from you.