Upcoming security changes: HTTP Voice Recording Media Endpoint CNAME Deprecation

We previously communicated that CNAME for unauthenticated access to HTTP Voice recording media URLs would be deprecated on February 5, 2024. This date is being pulled forward. 

As part of security and reliability initiatives, we’re rolling-out some important architecture changes to our Edge Infrastructure and as a result CNAME to serve media from custom hostname will no longer be supported starting November 1, 2023.

To ensure your Twilio account is able to fetch recording media files successfully, take the following actions: 

• Migrate to HTTPS (Recommended) 

  • Please move all your traffic from custom domain aliased (CNAME) to HTTPS before October 31, 2023. This will ensure your services are unaffected by our infrastructure upgrades.
    

• Update the DNS record 

  • As a temporary solution, update your current CNAME DNS records to virginia.us1.api-lb.twilio.com.  This solution will only be in place until February 5, 2024. After this date, all insecure http traffic to api.twilio.com will be blocked.

The timeline for accounts that access voice recordings media files using HTTP requests instead of HTTPS directly to api.twilio.com remains unchanged; although we highly recommend planning in advance and taking necessary action to prevent service interruption and failure to fetch recording media files.