---
title: "swscan.apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/swscan-apple-com"
description: "swscan.apple.com is an Apple host that macOS uses for software updates. What Apple says about it, and what breaks if you block it."
---

Updates and downloads

# swscan.apple.com

`swscan.apple.com` is an Apple host for macOS updates. Apple lists it for macOS only, on port 443. Its name and its place in Apple's list tie it to Software Update.

Run by Apple · Ports: 443 TCP · Checked: 1 November 2026

## Short answer

An Apple host for macOS updates, listed in Apple's software update section.

Don’t block

Don't block it. Apple lists it as needed for macOS updates.

Matches

`swscan.apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names `swscan.apple.com` in its Software updates section, for “macOS updates”, macOS only.

Apple gives the same short description to several hosts, including [`swcdn.apple.com`](https://kilobat.app/hosts/swcdn-apple-com), [`swdist.apple.com`](https://kilobat.app/hosts/swdist-apple-com) and [`swdownload.apple.com`](https://kilobat.app/hosts/swdownload-apple-com). It doesn't say what each one does.

On a Mac, [`softwareupdated`](https://kilobat.app/processes/softwareupdated) handles macOS updates, so its connections to this host belong to Software Update.

## Processes that use it

- [softwareupdated](https://kilobat.app/processes/softwareupdated): Part of macOS. It checks for and downloads macOS updates, security responses and system files.

## What breaks if you block it

Don’t block

Don't block it. Apple lists it as needed for macOS updates.

What breaks if you block it

- Software Update may fail to check for or install macOS updates.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

Apple says that its services fail any connection that uses HTTPS interception. A proxy that inspects TLS breaks Software Update too.

To save data on a hotspot, turn off “Download new updates when available” instead of blocking update hosts.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Support: Software Update settings on Mac](https://support.apple.com/guide/mac-help/software-update-settings-on-mac-mchla7037245/mac)

Checked on 1 November 2026.

## Related

- [mesu.apple.com](https://kilobat.app/hosts/mesu-apple-com): Apple's host for software update catalogs, the lists of updates that devices check against.
- [swcdn.apple.com](https://kilobat.app/hosts/swcdn-apple-com): Apple's host for macOS update downloads. Big transfers from it are macOS updates.
- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot)