Updates and downloads
updates.cdn-apple.com
updates.cdn-apple.com and updates-http.cdn-apple.com serve Apple's software update downloads. Apple lists them for every platform, on ports 443 and 80.
Short answer
Apple's hosts for software update downloads, over HTTPS and plain HTTP, for all Apple platforms.
Block with care
Blocking them stops software update downloads. Turn off automatic downloads instead, then update on your usual network.
- Matches
updates.cdn-apple.comupdates-http.cdn-apple.com
A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.
What it serves
Apple's enterprise host list names both hosts in its Software updates section, for “Software update downloads”, on iOS, iPadOS, tvOS, macOS and visionOS.
updates.cdn-apple.com uses port 443. updates-http.cdn-apple.com uses port 80. Apple lists both again for cellular carrier bundle updates.
On a Mac, macOS updates download through softwareupdated, so large transfers here are usually an update.
Processes that use it
What breaks if you block it
Block with care
Blocking them stops software update downloads. Turn off automatic downloads instead, then update on your usual network.
What breaks if you block it
- Software update downloads fail, so security fixes wait.
- Other Apple update content hosted there may not download.
With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.
Notes
Apple signs every update, and Apple Platform Security says that the install is checked against Apple's signing server. A download over port 80 is still verified.
Apple’s rules for its hosts
Apple’s list, Use Apple products on enterprise networks, says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.
If a firewall allows hosts by name, allowing *.apple.com covers most Apple services, Apple says. A firewall that works only with addresses can allow 17.0.0.0/8 for IPv4, and 2403:300::/32, 2620:149::/32 and 2a01:b740::/32 for IPv6.
To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the agent network log for AI agents.
Sources
- Apple Support: Use Apple products on enterprise networks
- Apple Platform Security: Secure software updates
Checked on 1 November 2026.