---
title: "*.apple-dns.net: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/apple-dns-net"
description: "apple-dns.net is the domain Apple lists for DNS of iCloud services. Why names such as gateway.fe2.apple-dns.net show up, and what breaks if you block it."
---

Core networking

# *.apple-dns.net

Hosts under `apple-dns.net` are Apple's. Apple lists the domain for “DNS for iCloud services”, on port 443 over TCP and UDP.

Run by Apple · Ports: 443 TCP and UDP · Checked: 1 November 2026

## Short answer

Apple's domain for the DNS of iCloud services. iCloud hosts resolve through names under it.

Don’t block

Don't block it. iCloud hosts resolve through it, so iCloud services can become unreachable.

Matches

`*.apple-dns.net`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names `*.apple-dns.net` in its iCloud section. Apple added it in July 2026.

From this Mac on 1 November 2026, `gateway.icloud.com` resolved through `gateway.fe2.apple-dns.net` to an address in 17.0.0.0/8.

So a name under `apple-dns.net` in a DNS log or firewall is usually an iCloud host after a CNAME.

## Processes that use it

- [mDNSResponder](https://kilobat.app/processes/mdnsresponder): Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups.
- [cloudd](https://kilobat.app/processes/cloudd): Part of macOS. It syncs the iCloud data of apps that use CloudKit, so its traffic belongs to those apps.

## What breaks if you block it

Don’t block

Don't block it. iCloud hosts resolve through it, so iCloud services can become unreachable.

What breaks if you block it

- iCloud hosts that resolve through it, such as gateway.icloud.com, may become unreachable.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- dig gateway.icloud.com, run on macOS 27.2 on 1 November 2026

Checked on 1 November 2026.

## Related

- [gateway.icloud.com](https://kilobat.app/hosts/gateway-icloud-com): Apple's CloudKit gateway. Apple lists it for CloudKit content, including XProtect malware definitions and Voice Control assets.
- [*.aaplimg.com](https://kilobat.app/hosts/aaplimg-com): An Apple domain behind Apple's content delivery. Many apple.com hosts resolve to names under it, so connections show up with it.