For network and security administrators allowing Mnemocast through a corporate firewall or a cloud security proxy such as Zscaler, Netskope or Palo Alto Prisma Access.
Updated 26 September 2026. Mnemocast is pre-release. These are the addresses and ports in service today. Media addresses will be added as capacity grows, and changes will be announced here before they take effect.
media.mnemocast.com and sfu.mnemocast.com from TLS inspection.These are the same exemptions administrators apply to Zoom, Microsoft Teams and Webex.
Web traffic is the app, the API and call signalling: ordinary HTTPS and secure WebSocket on TCP 443. Allow it by domain.
Media is audio, video and screen share: WebRTC over UDP, with fallbacks over TCP. Allow it by IP address, and do not inspect or proxy it.
Allow HTTPS (TCP 443) to the domains below. A wildcard rule for *.mnemocast.com covers all of them and any added later.
| Domain | Purpose | TLS inspection |
|---|---|---|
mnemocast.com, www.mnemocast.com, app.mnemocast.com | Web app | Allowed |
api.mnemocast.com | Platform API | Allowed |
sfu.mnemocast.com | Call signalling (secure WebSocket) | Exempt |
media.mnemocast.com | Media relay (TURN over TLS) | Exempt |
The addresses behind mnemocast.com, app, api and sfu belong to AWS load balancers, API Gateway and CloudFront, and change without notice. Do not allowlist them by IP.
Media flows directly between each participant and a Mnemocast media server.
| Media server address | Region |
|---|---|
3.233.24.118 | AWS us-east-1 |
Allow these ports outbound to the address above:
| Protocol | Port | Used for | Needed |
|---|---|---|---|
| UDP | 50000–60000 | Audio and video (RTP) | Strongly recommended; best quality |
| UDP | 3478 | STUN, and relay over UDP | Recommended |
| TCP | 7881 | Audio and video over TCP | Fallback when UDP is blocked |
| TCP | 443 | Relay over TLS (TURN/TLS) | Last resort; passes port filters, not TLS inspection |
Clients probe these paths together and prefer them in the order above, so a call uses the best one your network allows. The TCP paths add latency and degrade first under packet loss.
No TLS inspection for media.mnemocast.com and sfu.mnemocast.com. The media relay on port 443 carries TURN inside TLS, not HTTP. A proxy that decrypts it cannot parse it and drops the connection. The symptom is a call that starts, with names shown, but no one can be heard or seen.
Direct routing for media addresses. Send traffic for the media server addresses straight to the internet rather than through the proxy tunnel. Tunnelled media adds latency and jitter even when it works.
| Product | Where these settings usually live |
|---|---|
| Zscaler Internet Access | SSL inspection policy: a do-not-inspect rule by domain. Client Connector app profile or PAC file: a destination bypass for the media IPs. |
| Netskope | SSL decryption exceptions; steering configuration exceptions. |
| Palo Alto Prisma Access | Decryption exclusions; split tunnel by destination. |
Setting names vary by product version. The two exemptions are what matter, whatever they are called.
mnemocast.com was registered in September 2026. Policies that block newly registered or uncategorised domains will block Mnemocast entirely, and the app will not load. If users report that, allow *.mnemocast.com explicitly. Categorisation with the major filtering vendors is in progress.
| What users see | Usual cause |
|---|---|
| The app does not load | Domain blocked by reputation or category |
| Joining hangs and never connects | sfu.mnemocast.com blocked, or WebSocket upgrades blocked |
| Connects, but no audio or video | UDP blocked and the TLS relay inspected. Apply both exemptions. |
| Works, but choppy or delayed | Media tunnelled through the proxy. Route media directly. |
A self-service network check is planned. Until it ships, Mnemocast can run a test call with you and report which path a call on your network uses.