Core networking

*.aaplimg.com

aaplimg.com is a domain registered to Apple. Many Apple hosts, such as mesu.apple.com, resolve through a CNAME to a name under aaplimg.com, so firewalls and DNS logs show it.

Run by AppleChecked: 1 November 2026

Short answer

An Apple domain behind Apple's content delivery. Many apple.com hosts resolve to names under it, so connections show up with it.

Don’t block

Don't block it. It sits behind Apple hosts such as mesu.apple.com and swcdn.apple.com, so updates and other Apple services can fail.

Matches
*.aaplimg.com aaplimg.com

A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.

What it serves

WHOIS for aaplimg.com, checked on 1 November 2026, names Apple Inc. as the registrant.

From this Mac on the same day, mesu.apple.com resolved to mesu.g.aaplimg.com and swcdn.apple.com to swcdn.g.aaplimg.com, both with addresses in Apple's 17.0.0.0/8.

Apple's host list doesn't name aaplimg.com. It explains that some of its hosts have CNAME records, which can chain before they reach an address. Apple says that this provides fast and reliable content delivery.

So a connection to a name under aaplimg.com is usually one of Apple's listed hosts, after DNS.

Processes that use it

softwareupdatedPart of macOS. It checks for and downloads macOS updates, security responses and system files.Process →

What breaks if you block it

Don’t block

Don't block it. It sits behind Apple hosts such as mesu.apple.com and swcdn.apple.com, so updates and other Apple services can fail.

What breaks if you block it

  • Apple hosts that resolve through it, such as software update hosts, may become unreachable.
  • Apple doesn't list every host that uses it, so other Apple services may fail too.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.

Notes

Apple says to allow its hosts by name where possible, and otherwise 17.0.0.0/8 and its IPv6 ranges.

Apple’s rules for its hosts

Apple’s list, Use Apple products on enterprise networks, says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing *.apple.com covers most Apple services, Apple says. A firewall that works only with addresses can allow 17.0.0.0/8 for IPv4, and 2403:300::/32, 2620:149::/32 and 2a01:b740::/32 for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the agent network log for AI agents.

Sources

Checked on 1 November 2026.