Huawei Cloud Balance Recharge How to white list IP addresses in Huawei Cloud mail security settings

Huawei Cloud / 2026-09-01 14:35:13

If you’re searching this, you likely aren’t looking for UI tour instructions. You’re probably trying to unblock something practical: your team’s outbound email is being flagged by mail security, your mail service provider’s IPs changed after migration, or your company is implementing a stricter allowlist policy without breaking deliverability. Below I’ll focus on what I see most often in real Huawei Cloud mail security operations—especially the parts that tie directly into account risk control, KYC status, and day-2 operations.

What you’re trying to whitelist (and what usually breaks if you whitelist the wrong IP)

In practice, “white listing IPs” fails when people whitelist the wrong source:

Whitelisting the SMTP server IP when your mail provider actually connects through a different relay IP (common with managed email services).
Huawei Cloud Balance Recharge Whitelisting a public IP but your environment uses NAT with dynamic egress (cloud VPC NAT gateways / egress nodes may change).
Whitelisting IPv6 while your mail security is currently matching only IPv4 (or vice versa).
Whitelisting only the HELO/EHLO domain instead of the sending IP—domain-based trust rules are often separate from IP allowlists.

Actionable check before you change anything: capture the real client IP from the SMTP session log (or your ESP/dashboard). If you don’t have logs, ask whoever operates the mail relay to provide the IP that appears in Huawei Cloud’s block/notification events. Don’t guess—one wrong IP can keep you locked out and trigger repeated risk events.

Where to find the IP allowlist in Huawei Cloud (typical flow)

Huawei Cloud Balance Recharge Huawei Cloud has multiple mail-related security products and each UI name can differ by region/account setup. The most reliable approach is to locate the rule table from the product you already use for mail security:

Log in to Huawei Cloud Console.
Open the menu for your mail security / email security service (often under security or email protection).
Go to sections like IP Whitelist, Trust Policy, Anti-spam / Email Security Rules, or Allowlist.
Create a new rule:
- Set Rule Type to IP allowlist / trusted IP.
- Choose IP Version (IPv4/IPv6) if available.
- Enter IP/CIDR (e.g., 203.0.113.10 or 203.0.113.0/24 depending on UI).
- Set Scope (domain-based or global, if the UI supports it).
- Save & apply; confirm it becomes “Enabled”.

If you tell me which Huawei Cloud mail security product name you’re using (exact page label), I can map the likely menu names and rule dependencies.

Operational prerequisites that affect whether your whitelist actually takes effect

1) Your account must be in a “healthy” state (KYC / enterprise verification)

In real deployments, IP allowlists often appear editable even when the underlying account is under additional review. What you’ll see:

Rules save successfully, but enforcement doesn’t apply immediately.
System events show risk control / verification pending.
Changes get rolled back after a short period.

Practical recommendation:

If your account is new or you recently changed the billing subject, complete enterprise verification and ensure the identity info matches the billing profile.
Keep documentation ready (business license, legal representative ID, company address proof) because risk teams may ask for it after abnormal email traffic patterns.

2) Your payment status can indirectly block enforcement changes

This sounds indirect, but I’ve seen it: when a mail security subscription is expired or transitioning, the console allows “editing” while the enforcement pipeline is paused. Symptoms include:

Whitelist is present in the UI, but block logs still show actions taking place.
Huawei Cloud Balance Recharge Email continues to be quarantined until billing is renewed.

Action: check subscription status and the renewal timeline before testing your IP allowlist.

3) Rate-limit / quota settings can still throttle mail even after allowlisting

IP allowlisting generally addresses trust checks, not overall anti-abuse controls. If your sending volume suddenly spikes, you can still trigger throttling or temporary reputation actions.

After migration, send volume often doubles.
Your IP reputation may be lower until “warm-up” effects settle.

Practical fix: whitelist, then immediately reduce sending concurrency to a safe baseline for 30–60 minutes, monitor logs, then ramp gradually.

Step-by-step: a safe whitelist rollout to avoid accidental lockouts

Here’s the approach I use in production migrations—especially when you can’t afford a multi-hour mail outage.

Step 1: Create the rule as “narrow scope” first

If the UI supports domain or sender scope, apply the allowlist only to the specific sending domain(s) or tenant account that should be trusted. Avoid global allowlist unless you must.

Step 2: Use CIDR only when you control the full range

Whitelisting /24 ranges is convenient but risky. If your provider may share the infrastructure with other tenants, you effectively bypass trust checks.

Best: whitelist the exact egress IPs you control.
Acceptable: whitelist a small CIDR range tied to your NAT/relay.
Avoid: large ranges unless the vendor contract guarantees exclusivity.

Step 3: Validate with a single test sender and a controlled recipient list

Pick one or two representative recipients.
Use test subject/body to verify you’re not hitting content filters.
Send from the exact mail relay instance that will be used in production.

Step 4: Monitor enforcement outcome via logs/events

Don’t rely on “rule exists” confirmation. Look for:

Mail security event messages showing “trusted/allowed by IP” or equivalent.
Change in action from quarantine/reject to accept.

Step 5: After success, broaden scope only if needed

If only one domain is needed, keep it scoped. If multiple domains fail, add only their known egress IPs. This is where teams usually overcorrect and create a broad allowlist that later becomes a compliance risk.

Common reasons IP whitelist changes “don’t work” (and how to debug fast)

1) The sending IP isn’t the one in the SMTP connection

Tell: Your application server public IP differs from the mail relay IP. Managed email services often send via fixed relay IPs; your app may connect to them using different egress.

Fix: whitelist the relay IP shown in SMTP logs or in the mail security event details.

2) Reverse proxy / load balancer changes egress

If your outbound traffic goes through a load balancer/NAT gateway, the egress can change after scaling or failover.

Fix: pin egress (if supported) or whitelist all currently observed egress IPs temporarily and tighten after stability.

3) IPv4/IPv6 mismatch

Huawei Cloud Balance Recharge Fix: confirm which protocol your mail security matching uses. If your system supports dual-stack, you may need two allowlist entries.

4) Your rule is saved but not “enabled”

Huawei Cloud Balance Recharge Some consoles default new rules to disabled until you toggle them. This sounds trivial, but it’s one of the top causes of “whitelist not working.”

5) Account is under review / compliance restrictions

Huawei Cloud Balance Recharge When risk control flags suspicious patterns (sudden volume changes, domain spoofing patterns, or mismatched KYC/billing profile), enforcement behavior may not respond to allowlist changes immediately. You’ll often see:

More conservative actions despite allowlist
Delayed enforcement
Requests to complete verification

Fix: check verification and billing status, then retry after the risk team’s review window. If the console shows “restricted”, you typically need account-side remediation—not rule tweaks.

Cloud account purchasing & why it matters for mail security allowlists

This section is for users who may be considering buying/obtaining a Huawei Cloud account or transferring an existing subscription. I’ll be direct based on what I’ve seen during operational onboarding:

Mail security settings require account-level privileges. If the purchasing process results in incomplete enterprise verification or ownership transfer issues, you’ll have console access but limited enforcement changes.
Risk control review is tied to account identity. Allowlisting can be treated as part of “security policy configuration”, which may be limited when the account identity is uncertain.

Practical buying checklist (before you pay):

Confirm the account is already under enterprise verification (not just basic login).
Confirm the mail security product subscription is active in your intended region.
Ask the seller to provide evidence that the account can perform security rule edits and that changes propagate (test screenshot + log evidence).
Confirm domain verification status (if your mail security ties to domains).

Why this matters: if the allowlist doesn’t work due to verification issues, you’ll waste time and risk further restrictions from repeated failed email attempts.

KYC / enterprise verification: what usually gets flagged when you’re sending mail

People often think KYC is only about login—yet mail security involves reputation systems, anti-spam checks, and sometimes domain trust alignment. The risk team may ask questions when:

The billing entity doesn’t match the verified enterprise identity.
The account was registered recently and starts sending at high volume.
There’s mismatch between expected send domains and observed SMTP patterns.
Huawei Cloud Balance Recharge Multiple domains are used immediately after activation without warm-up.

Mitigation tactics:

Start with low volume for the first day; ramp gradually.
Keep outbound domains consistent with your verification documentation.
Use controlled test batches to validate the allowlist rule before production sends.

Payment methods: how they affect renewals and operational continuity

You didn’t ask for a billing tutorial, but in mail security scenarios the real problem is continuity: if renewal fails, enforcement can degrade and your whitelist changes become irrelevant during the gap.

Common payment patterns users choose

Prepaid / annual: fewer interruptions; best for stable outbound operations.
Monthly/On-demand: more flexible, but you must track renewal dates tightly.
Coupon/credits: can reduce cost but sometimes create confusion about service status if credits expire.

Actionable advice: before setting up allowlists, confirm:

Huawei Cloud Balance Recharge Renewal method and whether autopay is enabled.
Service region and subscription term alignment.
Whether there are separate billing items for the mail security product vs related features (some consoles show multiple line items).

Cost comparison: allowlisting vs “waiting out” reputation vs changing relay infrastructure

When people need whitelisting, the hidden cost is time loss and retry penalties. Here’s how to think in real terms:

Approach	Typical cost driver	Operational risk	When it’s best
Whitelist sender IPs in Huawei Cloud mail security	Time for rule setup + log verification	Low, if you whitelist correct relay IPs	After migration, stable relay IPs known
Wait for reputation to improve without allowlist changes	Retry / bounce cost (and user complaints)	High—deliverability may stay poor	Low volume, gradual ramp, content is clean
Change mail relay to use a different egress IP pool	Infrastructure changes + testing	Medium—may break integration	Current relay IP is shared/unstable
Mix allowlist + throttling/warm-up	Engineering time	Low to Medium (depends on process)	New domains/accounts, higher send volume

My recommendation in real incidents: do a narrow IP allowlist + immediate controlled ramp. It’s usually cheaper than repeated retries and higher complaint rates, which can themselves worsen reputation.

FAQ: the questions you’re probably actually asking

Q1: Do I need to whitelist for every sender IP?

Only the IPs that appear as the SMTP client/relay connection to Huawei Cloud mail security. If you use one relay IP per environment (prod/staging), whitelist those. If you have multiple relays (e.g., multiple regions, failover), you may need multiple IP entries or a small CIDR range that covers your controlled egress.

Q2: Can I whitelist by domain instead of IP?

Sometimes there’s a domain-based trust feature, but IP allowlist is usually the stricter and more direct mechanism for SMTP connection trust. If your domain is correct but the IP changes, domain rules may not be sufficient—confirm what the enforcement message says.

Q3: Why did my allowlist rule save, but mail still gets rejected?

Most common causes: wrong IP, IPv4/IPv6 mismatch, rule scope mismatch (domain/global), or account/subscription state not fully active. Less common but real: account risk control/compliance restriction delaying enforcement.

Q4: How long does it take for IP allowlist to take effect?

In many cases it applies quickly, but I’ve seen propagation delays when the mail security service is under active risk review or billing transitions. Don’t assume immediate effectiveness—always test with a single mail transaction and verify logs/events.

Q5: Does IP allowlisting increase compliance risk for enterprises?

It can, if you whitelist broad ranges or include third-party shared infrastructure. For enterprise environments, keep allowlists minimal, documented (who requested it, why), and periodically review. Risk reviewers often ask how you controlled the sender infrastructure.

Q6: I bought a Huawei Cloud account—can I still whitelist IPs?

Sometimes the console will allow configuration, but enforcement can be limited if enterprise verification, product subscription ownership, or billing subject transfer isn’t clean. Before relying on it in production, run a test and check the enforcement logs. If you’re blocked, you’ll need account-side remediation rather than more allowlist tuning.

Verification & operational “pre-flight” checklist (use this before you update the whitelist)

Confirm your SMTP relay IP(s) (not your app server IP).
Check subscription status for the mail security product (active, not expired/transitioning).
Ensure enterprise verification is complete and consistent with billing identity.
Decide scope: global vs domain-specific; prefer domain-specific if possible.
Whitelist narrow first; test with 1–2 recipients.
Monitor events/log messages to confirm “trusted by IP” behavior.
Document changes for compliance: who/when/why the IP was allowed.

If you want, I can tailor the exact steps to your situation

Reply with these details (no sensitive credentials):

Huawei Cloud mail security product name (or screenshot of the menu titles)
Your sending method (self-hosted SMTP relay / managed email provider / API-based)
Whether your traffic is IPv4 only or dual-stack (IPv4/IPv6)
The error message/action you see when it blocks (reject/quarantine/score threshold)
Any recent account changes (new account, billing renewal, region change, enterprise verification status)

Then I’ll suggest the most likely whitelist rule type, the correct scope, and a rollout plan that minimizes risk-control side effects.