Skip to content
AutoMark Docs

AutoMark on your school network

If AutoMark won’t load at school — a blocked-page message, a certificate warning, or a page that never finishes loading — your school’s web filter has most likely stopped it automatically. Nobody chose to block AutoMark; filters routinely hold back sites they haven’t categorised yet.

Send this page to your IT team. Everything below is written for them, and the fix is usually a two-minute allowlist entry.

For IT administrators

Section titled “For IT administrators”

AutoMark is a marking tool for teachers: it reads scanned, handwritten student tests and marks them against the teacher’s answer key, with every mark confirmed by the teacher before it is recorded. It is operated from Australia and hosted in Google Cloud’s australia-southeast1 (Sydney) region.

Domains to allowlist

Section titled “Domains to allowlist”
Host Purpose Required?
app.automarkhq.com The application and its API Yes
automarkhq.com Public website Recommended
docs.automarkhq.com This documentation Recommended
j.automarkhq.com Product analytics (first-party proxy) Optional — the app works fully without it

All four resolve to the same dedicated static address: 34.151.184.103 (Google Cloud, australia-southeast1). This address is exclusively ours — it is not shared PaaS or CDN infrastructure, so its reputation reflects only AutoMark.

Network behaviour, in full

Section titled “Network behaviour, in full”
  • Every connection is HTTPS on TCP 443. No other ports, no UDP, no WebSockets, no peer-to-peer, no long-lived idle sockets — plain request/response only.
  • TLS 1.2/1.3 with a Let’s Encrypt certificate. HTTP on port 80 only redirects to HTTPS.
  • The app’s only external origin is j.automarkhq.com (analytics). If your filter blocks it, the app degrades gracefully — nothing visible breaks.
  • API paths are plain REST (/api/...); no encoded payloads in URLs.

TLS inspection

Section titled “TLS inspection”

We ask that these hosts be exempted from TLS/SSL inspection. Teachers upload scans of student test papers — student personal information under the Privacy Act 1988 (Cth). Decrypting that traffic places student data in your inspection appliance’s memory and logs, which creates a records-handling obligation for the school as much as for us. The exemption also avoids certificate errors on teachers’ personal devices, which do not carry your appliance’s root certificate.

If your filter blocked it as a “new domain”

Section titled “If your filter blocked it as a “new domain””

automarkhq.com was registered in August 2026, so newly-registered-domain policies may hold it back for their standard window. The domains above are safe to allowlist explicitly; we have also requested Education categorisation from the major filter vendors.

Ubiquiti UniFi networks

Section titled “Ubiquiti UniFi networks”

UniFi’s Threat Management (Suricata with the Emerging Threats ruleset) is known to false-positive on cloud-hosted services and then re-block on every retry:

  1. In Settings → Security → Threat Management, add 34.151.184.103 to the allowlist so IPS inspection bypasses AutoMark’s address.
  2. If a specific ET signature fired, use suppress signature for that alert ID rather than disabling Threat Management.
  3. If Traffic Rules category-blocking is in use, confirm AutoMark’s traffic hasn’t been grouped into a blocked category.

Questions

Section titled “Questions”