---
title: "*.cdn-apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/cdn-apple-com"
description: "*.cdn-apple.com is an Apple domain that serves iCloud, software updates and other content. Which hosts are under it, and why blocking all of it breaks a lot."
---

Sync and cloud storage

# *.cdn-apple.com

Hosts under `cdn-apple.com` are Apple's content delivery. Apple lists the whole domain for iCloud services, and several hosts under it for other jobs.

Run by Apple · Ports: 443 TCP · Checked: 1 November 2026

## Short answer

An Apple content delivery domain. Apple lists it for iCloud services; update and sign-in hosts sit under it too.

Don’t block

Don't block the whole domain. iCloud, software updates and Apple Account sign-in use hosts under it.

Matches

`*.cdn-apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names `*.cdn-apple.com` in its iCloud section, for iCloud services.

Hosts under it with their own entries: [`updates.cdn-apple.com`](https://kilobat.app/hosts/updates-cdn-apple-com) for software update downloads, [`account.apple.com`](https://kilobat.app/hosts/account-apple-com) for Apple Account sign-in and [`app-site-association.cdn-apple.com`](https://kilobat.app/hosts/app-site-association) for universal links.

Apple also lists `fcs-keys-pub-prod.cdn-apple.com` and `idv.cdn-apple.com` for other features. Kilobat matches the most specific entry first.

## Processes that use it

- [cloudd](https://kilobat.app/processes/cloudd): Part of macOS. It syncs the iCloud data of apps that use CloudKit, so its traffic belongs to those apps.
- [softwareupdated](https://kilobat.app/processes/softwareupdated): Part of macOS. It checks for and downloads macOS updates, security responses and system files.

## What breaks if you block it

Don’t block

Don't block the whole domain. iCloud, software updates and Apple Account sign-in use hosts under it.

What breaks if you block it

- iCloud services may fail.
- Software update downloads from updates.cdn-apple.com fail.
- Apple Account sign-in in System Settings may fail.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)

Checked on 1 November 2026.

## Related

- [updates.cdn-apple.com](https://kilobat.app/hosts/updates-cdn-apple-com): Apple's hosts for software update downloads, over HTTPS and plain HTTP, for all Apple platforms.
- [*.icloud.com](https://kilobat.app/hosts/icloud-com): Apple's iCloud domain. Apple lists *.icloud.com for iCloud services; specific hosts under it have their own pages.