---
title: "*.aaplimg.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/aaplimg-com"
description: "aaplimg.com is an Apple domain that many apple.com hosts point to in DNS, such as mesu.apple.com and swcdn.apple.com. What it is and what blocking it breaks."
---

Core networking

# *.aaplimg.com

`aaplimg.com` is a domain registered to Apple. Many Apple hosts, such as `mesu.apple.com`, resolve through a CNAME to a name under `aaplimg.com`, so firewalls and DNS logs show it.

Run by Apple · Checked: 1 November 2026

## Short answer

An Apple domain behind Apple's content delivery. Many apple.com hosts resolve to names under it, so connections show up with it.

Don’t block

Don't block it. It sits behind Apple hosts such as mesu.apple.com and swcdn.apple.com, so updates and other Apple services can fail.

Matches

`*.aaplimg.com` `aaplimg.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

WHOIS for `aaplimg.com`, checked on 1 November 2026, names Apple Inc. as the registrant.

From this Mac on the same day, `mesu.apple.com` resolved to `mesu.g.aaplimg.com` and `swcdn.apple.com` to `swcdn.g.aaplimg.com`, both with addresses in Apple's 17.0.0.0/8.

Apple's host list doesn't name `aaplimg.com`. It explains that some of its hosts have CNAME records, which can chain before they reach an address. Apple says that this provides fast and reliable content delivery.

So a connection to a name under `aaplimg.com` is usually one of Apple's listed hosts, after DNS.

## Processes that use it

- [softwareupdated](https://kilobat.app/processes/softwareupdated): Part of macOS. It checks for and downloads macOS updates, security responses and system files.

## What breaks if you block it

Don’t block

Don't block it. It sits behind Apple hosts such as mesu.apple.com and swcdn.apple.com, so updates and other Apple services can fail.

What breaks if you block it

- Apple hosts that resolve through it, such as software update hosts, may become unreachable.
- Apple doesn't list every host that uses it, so other Apple services may fail too.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

Apple says to allow its hosts by name where possible, and otherwise 17.0.0.0/8 and its IPv6 ranges.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- whois aaplimg.com, run on 1 November 2026
- dig mesu.apple.com and dig swcdn.apple.com, run on macOS 27.2 on 1 November 2026

Checked on 1 November 2026.

## Related

- [mesu.apple.com](https://kilobat.app/hosts/mesu-apple-com): Apple's host for software update catalogs, the lists of updates that devices check against.
- [swcdn.apple.com](https://kilobat.app/hosts/swcdn-apple-com): Apple's host for macOS update downloads. Big transfers from it are macOS updates.
- [*.apple-dns.net](https://kilobat.app/hosts/apple-dns-net): Apple's domain for the DNS of iCloud services. iCloud hosts resolve through names under it.