Updates and downloads
swcdn.apple.com
swcdn.apple.com is an Apple host for macOS updates. Apple lists it for macOS only. Large downloads from it are software updates.
Short answer
Apple's host for macOS update downloads. Big transfers from it are macOS updates.
Block with care
Blocking it stops macOS updates from downloading. Turn off automatic downloads instead, then update on your usual network.
- Matches
swcdn.apple.com
A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.
What it serves
Apple's enterprise host list names swcdn.apple.com in its Software updates section, for “macOS updates”, macOS only, on ports 443 and 80.
On a Mac, softwareupdated downloads macOS updates, so its traffic to this host is usually a macOS update.
From this Mac on 1 November 2026, swcdn.apple.com resolved to a name under aaplimg.com, in 17.0.0.0/8.
Processes that use it
What breaks if you block it
Block with care
Blocking it stops macOS updates from downloading. Turn off automatic downloads instead, then update on your usual network.
What breaks if you block it
- macOS updates can't download, so security fixes wait.
- Other update content that Apple hosts there may not download.
With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.
Notes
A Mac with Content Caching on can keep these updates for other Macs on the network. Apple says that devices still contact Apple to complete an update.
Apple’s rules for its hosts
Apple’s list, Use Apple products on enterprise networks, says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.
If a firewall allows hosts by name, allowing *.apple.com covers most Apple services, Apple says. A firewall that works only with addresses can allow 17.0.0.0/8 for IPv4, and 2403:300::/32, 2620:149::/32 and 2a01:b740::/32 for IPv6.
To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the agent network log for AI agents.
Sources
- Apple Support: Use Apple products on enterprise networks
- Apple Platform Security: Secure software updates
- dig swcdn.apple.com, run on macOS 27.2 on 1 November 2026
Checked on 1 November 2026.