---
title: "Network allowlist (URLs & domains)"
description: "List of Topol Plugin URLs and domains that must be allow-listed so the editor can load assets and work correctly behind firewalls and proxies."
url: https://docs.topol.io/email-editor/guide/allowed-domains.html
---

# Network allowlist for the Topol Plugin

**The Topol Plugin loads assets, fonts, media search results, and thumbnails from several external hosts, and a strict firewall, proxy, or web filter has to allow them for the editor to work fully.**

Missing images, fonts that never load, or an empty media search usually trace back to one of the destinations below being blocked. Allow HTTPS (TCP port 443) to each, grouped by what it serves.

## Core plugin and API

```
https://v3.email-assets.topol.io
https://api.topol.io
```

`v3.email-assets.topol.io` serves the loader and the editor iframe; `api.topol.io` is the API the editor and your backend call.

## Fonts

```
https://fonts.googleapis.com
https://fonts.gstatic.com
```

`fonts.googleapis.com` returns the font stylesheets and `fonts.gstatic.com` serves the font files they reference, so both are needed for web fonts to render.

## Media search and stock images

```
https://api.giphy.com/v1/gifs/search
https://api.pexels.com
https://images.pexels.com
```

Giphy powers the GIF search. The stock-image picker queries `api.pexels.com` and loads the resulting thumbnails from `images.pexels.com`.

## Video thumbnails

```
https://vimeo.com
https://i.vimeocdn.com
https://img.youtube.com
https://d3j30ldhbe67w5.cloudfront.net
```

The video block resolves Vimeo thumbnails through `vimeo.com` and YouTube thumbnails through `img.youtube.com` and the CloudFront host, with `i.vimeocdn.com` used to compose a preview overlay.

## Image editor and template assets

```
https://d3ayqk5orocicw.cloudfront.net
https://d5aoblv5p04cg.cloudfront.net
https://cdn.jsdelivr.net
https://storage.googleapis.com
```

`d3ayqk5orocicw.cloudfront.net` loads the image-editor engine, `d5aoblv5p04cg.cloudfront.net` serves premade-block preview images, `cdn.jsdelivr.net` loads the code-view editor, and `storage.googleapis.com` hosts template and premade-content images.

> **WARNING**
>
> Blocking any of these leaves the matching feature degraded, so broken images, missing fonts, or an empty media search point to a host that is still filtered.