What is this host?
The servers your Mac talks to, explained.
54 hosts and host patterns you see in a firewall prompt, a DNS log or Kilobat’s Connections tab: who runs each one, what it serves, which processes use it and what breaks if you block it. Also see the processes behind them.
Sync and cloud storage
*.apple-cloudkit.comApple's CloudKit service. Apps sync their iCloud data through it, and Apple lists api.apple-cloudkit.com for app notarization on macOS.Apple · Don’t block*.cdn-apple.comAn Apple content delivery domain. Apple lists it for iCloud services; update and sign-in hosts sit under it too.Apple · Don’t blockdropbox.comDropbox's official domains for its product, API and static content.Dropbox · Block with care*.dropboxusercontent.comA Dropbox domain on its list of verified domains, with hosts such as dl.dropboxusercontent.com.Dropbox · Block with caregateway.icloud.comApple's CloudKit gateway. Apple lists it for CloudKit content, including XProtect malware definitions and Voice Control assets.Apple · Don’t block*.icloud-content.comAn Apple domain for iCloud services. Large uploads and downloads of iCloud content, such as files and photos, can go to hosts under it.Apple · Don’t block*.icloud.comApple's iCloud domain. Apple lists *.icloud.com for iCloud services; specific hosts under it have their own pages.Apple · Don’t blockonedrive.live.comHosts that Microsoft lists for consumer OneDrive, for file storage and the OneDrive service.Microsoft · Block with careUpdates and downloads
*.apps.apple.comApple's store content host, for apps, books and music, next to *.itunes.apple.com.Apple · Block with careaudiocontentdownload.apple.comApple's host for GarageBand downloadable content.Apple · Safe to blockconfiguration.apple.comThe Apple host that Apple lists for Rosetta 2 updates on macOS.Apple · Block with caredownload.developer.apple.comApple's hosts for Xcode's downloadable components.Apple · Safe to blockgdmf.apple.comApple's software update catalog host. Device management services also ask it which updates are available.Apple · Don’t blockgs.apple.comAn Apple host that devices need during setup and for operating system updates. Apple lists it in both sections of its host list.Apple · Don’t block*.itunes.apple.comApple's store content host, for apps, books and music.Apple · Block with carelcdn-locator.apple.comApple's Content Caching locator, which devices ask to find a caching Mac on their network.Apple · Safe to blocklcdn-registration.apple.comApple's hosts that a Content Caching Mac uses to register, get its configuration and report.Apple · Safe to blockmesu.apple.comApple's host for software update catalogs, the lists of updates that devices check against.Apple · Don’t block*.mzstatic.comAn Apple domain for store content such as apps, books and music, and apps from websites and alternative marketplaces.Apple · Block with careosrecovery.apple.comApple's hosts for macOS Recovery, used when you reinstall macOS over the internet.Apple · Block with careswcdn.apple.comApple's host for macOS update downloads. Big transfers from it are macOS updates.Apple · Block with careswdist.apple.comAn Apple host for macOS updates, listed in Apple's software update section.Apple · Don’t blockswdownload.apple.comAn Apple host for macOS update downloads. Apple says that it works through proxies.Apple · Block with careswscan.apple.comAn Apple host for macOS updates, listed in Apple's software update section.Apple · Don’t blocksylvan.apple.comApple's host for Aerial screen savers and wallpapers on tvOS and macOS.Apple · Safe to blockupdates.cdn-apple.comApple's hosts for software update downloads, over HTTPS and plain HTTP, for all Apple platforms.Apple · Block with carexp.apple.comAn Apple host that Apple lists in the software update section of its host list, without saying what it does.Apple · Block with careCore networking
*.aaplimg.comAn Apple domain behind Apple's content delivery. Many apple.com hosts resolve to names under it, so connections show up with it.Apple · Don’t blockapp-site-association.cdn-apple.comApple's hosts for Associated Domains, which universal links and other app-to-website links rely on.Apple · Block with care*.apple-dns.netApple's domain for the DNS of iCloud services. iCloud hosts resolve through names under it.Apple · Don’t blockcaptive.apple.comApple's internet connectivity check for networks with sign-in pages (captive portals). Kilobat uses it too.Apple · Don’t blockdoh.dns.apple.comApple's DNS over HTTPS (DoH) host. Apple lists it for encrypted DNS resolution in macOS Big Sur and later.Apple · Block with caremask-api.icloud.comAn iCloud Private Relay host on TCP 443. Unlike the relay hosts, Apple says that it supports proxies.Apple · Block with caremask.icloud.comThe iCloud Private Relay hosts. With Private Relay on, Safari browsing and DNS lookups go through them.Apple · Block with careprobe.icloud.comApple's iCloud connection testing hosts.Apple · Block with caretime.apple.comApple's time servers. Macs use NTP on UDP port 123 to set their date and time from them.Apple · Don’t blockSecurity and accounts
account.apple.comApple's hosts for Apple Account authentication in Settings and System Settings.Apple · Don’t blockalbert.apple.comApple's device activation host, needed during setup and when installing, updating or restoring the operating system.Apple · Don’t blockcrl.apple.comApple's hosts for certificate revocation lists and certificates, used to validate the certificates of Apple's services.Apple · Don’t blockidmsa.apple.comApple's Apple Account authentication hosts. Signing in to iCloud, the App Store and Xcode needs them.Apple · Don’t blockocsp.apple.comApple's certificate status (OCSP) servers. The Mac asks them whether an Apple-issued certificate has been revoked.Apple · Don’t blockocsp.digicert.comDigiCert's certificate status and revocation list hosts. Apple lists them because some of its services use DigiCert certificates.DigiCert · Don’t blocktoken.safebrowsing.appleThe Apple host for Safari's fraudulent website warnings.Apple · Don’t blockvalid.apple.comAn Apple certificate validation host. Apple lists it for every platform, on port 443, with proxy support.Apple · Don’t blockApple services
apple-relay.apple.comThe Apple host that Apple lists for Apple Intelligence Extensions.Apple · Block with careapple-relay.cloudflare.comHosts on Cloudflare and Fastly that Apple lists for Private Cloud Compute, where some Apple Intelligence requests are processed.Apple, through Cloudflare and Fastly · Block with careguzzoni.apple.comApple's host for Siri and dictation requests.Apple · Safe to block*.push.apple.comThe Apple Push Notification service (APNs). The Mac keeps one connection to it, so notifications, iMessage, FaceTime calls and iCloud changes can arrive.Apple · Don’t block*.smoot.apple.comApple's search services, for suggestions in Siri, Spotlight, Look Up, Safari, News, Messages and Music.Apple · Safe to blockDiagnostics, analytics and ads
Apps and helpers
dl.google.comGoogle's download host, where Chrome gets its updates.Google · Block with careregistry.npmjs.orgThe npm public registry, where npm downloads JavaScript packages by default.npm · Block with care*.zoom.usZoom's domains for all Zoom clients, over TCP 80 and 443 and UDP 443.Zoom · Block with careTo find which app opened a connection, use Kilobat’s Connections tab or the agent network log. Checked on 1 November 2026.