Allowed IP addresses and team network access

Allow sign-in only from your networks

Available on every plan, for your own account.

1. Open Settings → Security → Allowed IP addresses

   The card shows the IP address you are connecting from right now.

2. Add your addresses

   Click Add my current IP, or type an address such as 203.0.113.7 or a range such as 203.0.113.0/24 or 2001:db8::/32. A label (“Office”, “Home VPN”) helps you remember which is which.

3. Turn on “Only allow sign-in from these addresses” and save

   Sessions signed in from other networks are signed out right away; this device stays signed in. You get a security email about the change.

From then on, password, passkey and Google sign-in, the two-factor step, keeping a session alive and your API keys all work only from the listed addresses. A session that moves to another network is signed out within 15 minutes.

You cannot lock yourself out by mistake

DNSPeek refuses to save a list that does not include the address you are using at that moment. The error offers Add my current IP, so fixing it is one click. The same rule applies to team network access.

Signed in from a new network? Unlock your account

When the right password (or Google account) is used from an address that is not on your list, the sign-in is refused and the page shows the address it came from. We email you about the blocked attempt, with the address, browser and time.

1. Open “Turn off the IP restriction” in the email

   The link works once and expires after 30 minutes. Open it on the device you want to sign in with.

2. Click Continue, then sign in within 15 minutes

   Sign in from the same network as usual, including your two-factor code if it is on. When the sign-in completes, your IP restriction is turned off and you get a security email.

3. Set it up again

   Your saved addresses are kept. Add the new one in Settings → Security and turn the restriction back on.

Restrict a team to approved networks

On the Agency and Provider plans, workspace owners and admins can open Workspace → Policies → Network access and list the office and VPN addresses the team works from. While it is on, every request in that workspace from another address is refused: the dashboard, the REST API with API keys, and exports. Members see a page saying Your team restricts access to approved networks with their current IP, so they can send it to an admin.

• Owners are not exempt: that is the point of the rule. Saving a list without your own address is refused.
• Saving (including turning it off) needs a sign-in from the last 10 minutes; otherwise DNSPeek asks you to confirm it is you with a passkey, an authenticator code or your password, as for your personal list.
• Other workspaces of the same people (their personal workspace, other teams) are not affected.
• If the plan no longer includes IP allowlists, the saved list is kept but not enforced.

Locked out completely?

If everyone who could change a team’s network access is now outside the list (for example the office address changed), or you cannot receive the unlock email, contact support from the email address of the account. After confirming you own the account or workspace, DNSPeek support can clear the list; the change is recorded in our audit log and the account owner gets a security email.