> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exec.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network and Email Whitelist Requirements

> Domains, ports, and email sender addresses to allow through your firewall and email security gateway.

This guide lists the domains, ports, and email sender addresses that IT and infosec teams need to allow so Exec works on your corporate network and so Exec emails reach your users.

## Quick Reference

| Category           | Value                  | Purpose                            |
| :----------------- | :--------------------- | :--------------------------------- |
| Protocol and port  | TCP 443 (HTTPS / WSS)  | All browser traffic                |
| Firewall whitelist | `*.exec.com`           | App, login, and customer workspace |
| Firewall whitelist | `*.execprod.io`        | Supporting production services     |
| Firewall whitelist | `*.livekit.cloud`      | Voice roleplay signaling and media |
| Firewall whitelist | `*.turn.livekit.cloud` | Voice roleplay media relay         |
| Firewall whitelist | `*.vapi.ai`            | Voice roleplay API and signaling   |
| Firewall whitelist | `*.daily.co`           | Voice roleplay media transport     |
| Email sender       | `mg.exec.com`          | Transactional email sender         |

All browser traffic to Exec flows over TCP port 443. Allow the firewall domains listed above through your corporate firewall.

## Voice Roleplay Audio Quality

Voice roleplays work with only the TCP 443 entries above. For the best audio quality, also allow the outbound UDP rules below so calls can take a direct media path instead of relaying over TLS.

| Value                              | Purpose                |
| :--------------------------------- | :--------------------- |
| `*.host.livekit.cloud` on UDP 3478 | TURN/UDP media servers |
| UDP 50000-60000                    | Direct WebRTC media    |

These UDP rules are optional. When they are blocked, calls automatically fall back to `*.turn.livekit.cloud` over TCP 443.

## Email Sender Whitelist

Exec sends transactional email (user invitations, password resets, notifications) from **`mg.exec.com`**. Your email security gateway or mail transport rules need to allow or trust this sender domain so Exec emails are not quarantined or routed to junk. This is typically handled by the IT or messaging team rather than infosec.

## SSO and MFA

For customers who want authentication controls beyond named user accounts, Exec supports SSO via SAML and OpenID Connect. MFA is inherited from your identity provider.

See [Single Sign-On and Directory Sync](/sso-directory-sync) for setup instructions and supported identity providers.