Core networking

*.apple-dns.net

Hosts under apple-dns.net are Apple's. Apple lists the domain for “DNS for iCloud services”, on port 443 over TCP and UDP.

Run by ApplePorts: 443 TCP and UDPChecked: 1 November 2026

Short answer

Apple's domain for the DNS of iCloud services. iCloud hosts resolve through names under it.

Don’t block

Don't block it. iCloud hosts resolve through it, so iCloud services can become unreachable.

Matches
*.apple-dns.net

A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.

What it serves

Apple's enterprise host list names *.apple-dns.net in its iCloud section. Apple added it in July 2026.

From this Mac on 1 November 2026, gateway.icloud.com resolved through gateway.fe2.apple-dns.net to an address in 17.0.0.0/8.

So a name under apple-dns.net in a DNS log or firewall is usually an iCloud host after a CNAME.

Processes that use it

mDNSResponderPart of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups.Process →clouddPart of macOS. It syncs the iCloud data of apps that use CloudKit, so its traffic belongs to those apps.Process →

What breaks if you block it

Don’t block

Don't block it. iCloud hosts resolve through it, so iCloud services can become unreachable.

What breaks if you block it

  • iCloud hosts that resolve through it, such as gateway.icloud.com, may become unreachable.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.

Apple’s rules for its hosts

Apple’s list, Use Apple products on enterprise networks, says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing *.apple.com covers most Apple services, Apple says. A firewall that works only with addresses can allow 17.0.0.0/8 for IPv4, and 2403:300::/32, 2620:149::/32 and 2a01:b740::/32 for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the agent network log for AI agents.

Sources

Checked on 1 November 2026.