---
title: "swdist.apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/swdist-apple-com"
description: "swdist.apple.com is an Apple host that macOS uses for software updates. What Apple says about it, and what breaks if you block it."
---

Updates and downloads

# swdist.apple.com

`swdist.apple.com` is an Apple host for macOS updates. Apple lists it for macOS only, on port 443, next to the other Software Update hosts.

Run by Apple · Ports: 443 TCP · Checked: 1 November 2026

## Short answer

An Apple host for macOS updates, listed in Apple's software update section.

Don’t block

Don't block it. Apple lists it as needed for macOS updates.

Matches

`swdist.apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names `swdist.apple.com` in its Software updates section, for “macOS updates”, macOS only.

Apple gives the same description to several hosts, such as [`swscan.apple.com`](https://kilobat.app/hosts/swscan-apple-com) and [`swcdn.apple.com`](https://kilobat.app/hosts/swcdn-apple-com). It doesn't describe each one's role.

On a Mac, [`softwareupdated`](https://kilobat.app/processes/softwareupdated) handles macOS updates, so its connections here are Software Update's.

## Processes that use it

- [softwareupdated](https://kilobat.app/processes/softwareupdated): Part of macOS. It checks for and downloads macOS updates, security responses and system files.

## What breaks if you block it

Don’t block

Don't block it. Apple lists it as needed for macOS updates.

What breaks if you block it

- Software Update may fail to check for or install macOS updates.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

To save data on a hotspot, turn off automatic downloads in Software Update rather than blocking its hosts.

A firewall that allows only addresses can allow Apple's 17.0.0.0/8, Apple says.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Support: Software Update settings on Mac](https://support.apple.com/guide/mac-help/software-update-settings-on-mac-mchla7037245/mac)

Checked on 1 November 2026.

## Related

- [swscan.apple.com](https://kilobat.app/hosts/swscan-apple-com): An Apple host for macOS updates, listed in Apple's software update section.
- [swdownload.apple.com](https://kilobat.app/hosts/swdownload-apple-com): An Apple host for macOS update downloads. Apple says that it works through proxies.
- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot)