---
title: "lcdn-registration.apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/lcdn-registration-apple-com"
description: "lcdn-registration.apple.com, suconfig.apple.com and xp-cdn.apple.com let a Mac offer Content Caching. What each does, and what breaks if you block them."
---

Updates and downloads

# lcdn-registration.apple.com

A Mac that provides Content Caching needs `lcdn-registration.apple.com` to register, `suconfig.apple.com` for configuration and `xp-cdn.apple.com` for reporting.

Run by Apple · Ports: 443 TCP (lcdn-registration, xp-cdn), 80 TCP (suconfig) · Checked: 1 November 2026

## Short answer

Apple's hosts that a Content Caching Mac uses to register, get its configuration and report.

Safe to block

Safe to block if this Mac doesn't offer Content Caching. If it does, caching stops working.

Matches

`lcdn-registration.apple.com` `suconfig.apple.com` `xp-cdn.apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list says that a Mac that provides Content Caching needs these three hosts, plus the hosts of the content it caches.

Apple lists `lcdn-registration.apple.com` for “Server registration”, `suconfig.apple.com` for “Configuration” and `xp-cdn.apple.com` for “Reporting”.

On a Mac, Content Caching is [`AssetCache`](https://kilobat.app/processes/assetcache).

## Processes that use it

- [AssetCache](https://kilobat.app/processes/assetcache): Part of macOS. It is Content Caching. It keeps Apple downloads on this Mac and gives them to other Apple devices on the same network.

## What breaks if you block it

Safe to block

Safe to block if this Mac doesn't offer Content Caching. If it does, caching stops working.

What breaks if you block it

- This Mac can't register as a Content Caching server, so other devices download from Apple directly.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Support: Change Content Caching settings on Mac](https://support.apple.com/guide/mac-help/about-content-caching-on-mac-mchleaf1e61d/mac)

Checked on 1 November 2026.

## Related

- [lcdn-locator.apple.com](https://kilobat.app/hosts/lcdn-locator-apple-com): Apple's Content Caching locator, which devices ask to find a caching Mac on their network.
- [xp.apple.com](https://kilobat.app/hosts/xp-apple-com): An Apple host that Apple lists in the software update section of its host list, without saying what it does.