Outbound proxy
The Core UI service makes a few requests to hosts on the internet. In deployments where pods can only reach the internet through an HTTP(S) proxy, configure that proxy in the core-ui Helm chart. Without it, these requests time out.
Availability Since 8.51.
Which requests go out
| Feature | Requests | Ports |
|---|---|---|
| One-click unsubscribe | POST to the sender's unsubscribe URL | 443 |
| BIMI | Sender logo (SVG) and certificate (VMC) | 443 |
| BIMI | Intermediate CA certificates referenced by the VMC | 80 |
DNS lookups (BIMI records, and resolving the hosts above) are not proxied. The service needs a resolver that answers for public names.
Configuration
proxy:
# proxy for all outbound requests; credentials are optional
https: "http://user:password@proxy.example.com:3128"
# comma-separated hosts or domains that bypass the proxy
noProxy: "localhost,.corp.example"
The chart passes these values to the container as HTTPS_PROXY and NO_PROXY. Both http:// and https:// proxy URLs are supported. In noProxy, example.com and .example.com both match the domain and all of its subdomains, and * turns the proxy off.
Credentials in proxy.https end up in the Deployment's pod spec. If that is not acceptable, use a proxy that authenticates the pod by its source address instead.
What the proxy must allow
The service resolves each target host itself and rejects it if any address is not public (loopback, private, link-local, unique-local and other reserved ranges). It then asks the proxy to open a tunnel to the validated IP address, not to the hostname, for example CONNECT 93.184.215.14:443. This way the proxy cannot resolve the name to a different, possibly internal, address. TLS and the Host header still use the original hostname, so certificate validation is unaffected.
The proxy therefore has to allow:
CONNECTto IP addresses. A proxy that only accepts allowlisted hostnames rejects every request.CONNECTto port 443, and to port 80 for BIMI's intermediate certificates. Many proxies, such as Squid with its default configuration, only allowCONNECTto port 443.
If the proxy does not allow port 80, BIMI cannot download intermediate certificates. Certificate validation then fails and senders' logos are not shown. In that case, either allow port 80 or turn BIMI off. One-click unsubscribe only needs port 443.
Further reading
- Core UI service: outbound requests: the rules every outbound request follows
- BIMI: prerequisites and configuration