It looks like they have about 6 total. Plus some customers pay $100/month for their own front-end proxy server so they can use SSL on a custom domain name.

Of the domains I checked (a few hundred found through the "Find Subdomains" tool here: http://www.magic-net.info/), appname.heroku.com (including proxy.heroku.com) will return 3 of these:

    50.16.215.196
    50.16.232.130
    50.16.233.102
    75.101.145.87
    174.129.212.2

It's possible Heroku's DNS is returning different IPs based the load of the reverse proxies, but when querying heroku.com's 4 nameservers directly I got different subsets of those 5 IPs. A random distribution of IPs probably gives good enough load distribution.

And Heroku's documentation says to point A records to these three:

    75.101.163.44
    75.101.145.87
    174.129.212.2

It's also interesting to note that apps aren't tied to specific proxy servers. If you set the "Host" header to your app's subdomain, a request to any one of those IPs will work.

I'll add this info the the Quora answer.

Yup. Amazon has 3 too!

     $ dig amazon.com

    ; <<>> DiG 9.7.0-P1 <<>> amazon.com
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41998
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;amazon.com.      IN  A

    ;; ANSWER SECTION:
    amazon.com.   36  IN  A 72.21.194.1
    amazon.com.   36  IN  A 72.21.211.176
    amazon.com.   36  IN  A 72.21.214.128