Apple services
*.push.apple.com
Hosts under push.apple.com run the Apple Push Notification service (APNs). On a Mac, apsd keeps one connection to them, so apps and Apple services can reach the Mac.
Short answer
The Apple Push Notification service (APNs). The Mac keeps one connection to it, so notifications, iMessage, FaceTime calls and iCloud changes can arrive.
Don’t block
Don't block it. Notifications, iMessage, FaceTime calls and many iCloud updates arrive through it.
- Matches
*.push.apple.com
A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.
What it serves
Apple's enterprise host list names *.push.apple.com for push notifications, on TCP ports 443, 80, 5223 and 2197.
Apple says that devices use port 5223 first. Port 443 is the fallback, and devices can reach APNs through an HTTP proxy, also one set by a PAC file.
Apple Platform Security says that iMessage messages and incoming phone calls on the Mac are delivered through APNs.
Processes that use it
apsdPart of macOS. It keeps one connection open to Apple's push notification service, so apps and iCloud can tell the Mac that something changed.Process →imagentPart of macOS, not documented by Apple. It is the agent behind the Messages app, in the IMCore framework, so iMessage traffic can show under it.Process →callservicesdPart of macOS. callservicesd keeps the state of calls, and CommCenter lets the Mac make and receive phone calls through your iPhone.Process →identityservicesdPart of macOS. It is the client of the Apple Identity Service, which finds the keys and devices of the people you message or call.Process →What breaks if you block it
Don’t block
Don't block it. Notifications, iMessage, FaceTime calls and many iCloud updates arrive through it.
What breaks if you block it
- App notifications stop arriving.
- iMessage, FaceTime and phone calls on the Mac can't receive.
- iCloud services that wait for a push, such as mail and calendars, update late.
With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.
Notes
Apple owns 17.0.0.0/8. A firewall that allows only addresses can allow that range, plus Apple's IPv6 ranges in the same article.
Apple’s rules for its hosts
Apple’s list, Use Apple products on enterprise networks, says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.
If a firewall allows hosts by name, allowing *.apple.com covers most Apple services, Apple says. A firewall that works only with addresses can allow 17.0.0.0/8 for IPv4, and 2403:300::/32, 2620:149::/32 and 2a01:b740::/32 for IPv6.
To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the agent network log for AI agents.
Sources
- Apple Support: Use Apple products on enterprise networks
- Apple Support: If your Apple devices aren't getting Apple push notifications
- Apple Platform Security: How iMessage sends and receives messages securely
Checked on 1 November 2026.