---
title: "swcdn.apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/swcdn-apple-com"
description: "swcdn.apple.com is one of Apple's macOS update download hosts. Why it uses so much data, and what breaks if you block it."
---

Updates and downloads

# swcdn.apple.com

`swcdn.apple.com` is an Apple host for macOS updates. Apple lists it for macOS only. Large downloads from it are software updates.

Run by Apple · Ports: 443 and 80 TCP · Checked: 1 November 2026

## Short answer

Apple's host for macOS update downloads. Big transfers from it are macOS updates.

Block with care

Blocking it stops macOS updates from downloading. Turn off automatic downloads instead, then update on your usual network.

Matches

`swcdn.apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names `swcdn.apple.com` in its Software updates section, for “macOS updates”, macOS only, on ports 443 and 80.

On a Mac, [`softwareupdated`](https://kilobat.app/processes/softwareupdated) downloads macOS updates, so its traffic to this host is usually a macOS update.

From this Mac on 1 November 2026, `swcdn.apple.com` resolved to a name under `aaplimg.com`, in 17.0.0.0/8.

## Processes that use it

- [softwareupdated](https://kilobat.app/processes/softwareupdated): Part of macOS. It checks for and downloads macOS updates, security responses and system files.

## What breaks if you block it

Block with care

Blocking it stops macOS updates from downloading. Turn off automatic downloads instead, then update on your usual network.

What breaks if you block it

- macOS updates can't download, so security fixes wait.
- Other update content that Apple hosts there may not download.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

A Mac with Content Caching on can keep these updates for other Macs on the network. Apple says that devices still contact Apple to complete an update.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Platform Security: Secure software updates](https://support.apple.com/guide/security/secure-software-updates-secf683e0b36/web)
- dig swcdn.apple.com, run on macOS 27.2 on 1 November 2026

Checked on 1 November 2026.

## Related

- [swscan.apple.com](https://kilobat.app/hosts/swscan-apple-com): An Apple host for macOS updates, listed in Apple's software update section.
- [swdist.apple.com](https://kilobat.app/hosts/swdist-apple-com): An Apple host for macOS updates, listed in Apple's software update section.
- [swdownload.apple.com](https://kilobat.app/hosts/swdownload-apple-com): An Apple host for macOS update downloads. Apple says that it works through proxies.
- [updates.cdn-apple.com](https://kilobat.app/hosts/updates-cdn-apple-com): Apple's hosts for software update downloads, over HTTPS and plain HTTP, for all Apple platforms.
- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot)