Sophos Endpoint network and proxy requirements
Sophos Central Endpoint needs outbound DNS and HTTPS to Sophos services. Basic requirements are port 53 for name resolution and port 443 for Central communication, updates, Live Protection and other licensed functions.
Implement access on the network firewalls and proxies actually in use. A Sophos Firewall appliance is not required or configured here. The endpoint simply needs a reliable intended path.
Domains instead of static IP lists
Sophos operates services across regions and cloud platforms. Where infrastructure permits, allow the officially documented wildcard domains. A fixed AWS-region or IP list can change and fail unnecessarily.
Where wildcards are impossible, use the current regional Sophos list. Also include required certificate authorities, Management Communication System, SophosLabs Intelix and, by licence, XDR or Live Response destinations.
The current core wildcard allowlist is:
*.sophos.com
*.sophosxl.com
*.sophosxl.net
*.sophosupd.com
*.sophosupd.net
*.hitmanpro.com
Depending on the trust chain, *.globalsign.com, *.globalsign.net, and *.digicert.com may also be required. Without wildcard support, additional entries include az416426.vo.msecnd.net, dc.services.visualstudio.com, and the regional MCS and installer destinations. These exact lists are dynamic; compare them with the current Sophos requirements during each change and document the effective access.
Connection order
For Central communication, the agent checks paths in this order:
- Message Relay
- proxy configured in Sophos Central
- system proxy
- WPAD, except on Linux
- direct connection
Several simultaneous paths complicate diagnosis. In controlled networks, plan a preferred route and consciously permit or prevent each fallback.
Central Proxy Configuration
Under Global Settings > Products and Services > Endpoint and Server > Proxy Configuration, configure host and port with optional credentials or a PAC URL. A stored password cannot later be read. Saving new details can overwrite the previous value.
A service account receives only necessary rights and is not used interactively. Monitor expiry, rotation and lockout. A TLS-inspecting proxy must not alter the Sophos connection so certificate checking or agent communication fails.
During initial Windows installation, pass a proxy with SophosSetup.exe --proxyaddress=<host:port> or a PAC file with --pacurl=<url>. These parameters cover only bootstrap. After registration, Central distributes the permanent configuration. Command-line passwords are visible in process and deployment logs, so supply them through the deployment platform’s secret facility.
The agent tries Message Relay first, followed by the proxy configured in Central, the system proxy, WPAD, and finally a direct connection. WPAD is unavailable on Linux. Also test the execution context: GPO startup scripts and software deployment often run the installer as SYSTEM, whose proxy and internet access may differ from the interactive user.
Sophos MCS connections must validate the original Sophos certificate. Exclude current Sophos domains from TLS inspection rather than trusting the inspection CA in place of the expected MCS certificate. TLS interception can occur in a firewall, proxy, VPN client or other network software.
If a third-party web filter needs the regional MCS destination and certificate, open the MCS configuration on an already managed endpoint under C:\ProgramData\Sophos\Management Communications System\Endpoint\Config and use the server address from the configuration file. Retrieve the certificate directly from that Sophos destination and verify it as the filter’s trust reference. This does not solve a failed first installation; allow the official domains and ports for bootstrap.
Update Cache and Message Relay
Update Cache serves update content locally on port 8191. Message Relay brokers management communication on port 8190 and can only run on a device with Update Cache. A Windows 10 client can be a Cache but not Message Relay.
Cache and Relay need at least 5 GB free space. Sophos recommends Windows Server 2016 or later for both. Macs can download from Cache but do not use Message Relay.
Initial installation can use an existing Cache. Devices without direct Central access also need a prepared Message Relay. Install and test both before rollout.
Segmented and mobile networks
A notebook must work in office, home office and VPN. If only the internal Relay path is allowed, it may lose contact externally. If direct access is allowed, operations must consciously accept the fallback.
For segmented networks, test DNS, 443, 8190 and 8191 between correct sources and destinations. A successful browser request does not prove the agent works with its service account, proxy method and certificate path.
Diagnosis
For communication failure, check bottom-up: DNS resolution, TCP connection, proxy authentication, TLS, Sophos domain and finally Central registration. Record time, source network and path.
If only updates fail, check Cache port, storage and activity. If updates work but Central does not, focus on Message Relay or proxy. If failure occurs only outside the office, compare PAC, WPAD and allowed fallbacks.
Geographic blocks can unintentionally block Sophos cloud destinations because cloud regions are dynamic. Broad country allowance is not automatically required, but do not block Sophos domains solely by assumed hosting region.
WinHttpSendRequest failed 12007 indicates failed name resolution or an unreachable Sophos destination name. Compare repeated HTTP status codes 500, 502, 503 or 504 in McsClient.log with Sophos Central Status and the exact time window. Isolated occurrences are usually transient; frequent errors without a Central incident point back to proxy, relay, TLS and packet capture.
Related articles
Sophos Endpoint updates, Cache and Message Relay covers Cache, Relay and packages. Use Automate Sophos Endpoint rollout on Windows for installer parameters.