---
title: "updates.cdn-apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/updates-cdn-apple-com"
description: "updates.cdn-apple.com and updates-http.cdn-apple.com serve Apple software update downloads. Why they use so much data, and what breaks if you block them."
---

Updates and downloads

# updates.cdn-apple.com

`updates.cdn-apple.com` and `updates-http.cdn-apple.com` serve Apple's software update downloads. Apple lists them for every platform, on ports 443 and 80.

Run by Apple · Ports: 443 TCP (updates), 80 TCP (updates-http) · Checked: 1 November 2026

## Short answer

Apple's hosts for software update downloads, over HTTPS and plain HTTP, for all Apple platforms.

Block with care

Blocking them stops software update downloads. Turn off automatic downloads instead, then update on your usual network.

Matches

`updates.cdn-apple.com` `updates-http.cdn-apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names both hosts in its Software updates section, for “Software update downloads”, on iOS, iPadOS, tvOS, macOS and visionOS.

`updates.cdn-apple.com` uses port 443. `updates-http.cdn-apple.com` uses port 80. Apple lists both again for cellular carrier bundle updates.

On a Mac, macOS updates download through [`softwareupdated`](https://kilobat.app/processes/softwareupdated), so large transfers here are usually an update.

## Processes that use it

- [softwareupdated](https://kilobat.app/processes/softwareupdated): Part of macOS. It checks for and downloads macOS updates, security responses and system files.

## What breaks if you block it

Block with care

Blocking them stops software update downloads. Turn off automatic downloads instead, then update on your usual network.

What breaks if you block it

- Software update downloads fail, so security fixes wait.
- Other Apple update content hosted there may not download.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

Apple signs every update, and Apple Platform Security says that the install is checked against Apple's signing server. A download over port 80 is still verified.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Platform Security: Secure software updates](https://support.apple.com/guide/security/secure-software-updates-secf683e0b36/web)

Checked on 1 November 2026.

## Related

- [swcdn.apple.com](https://kilobat.app/hosts/swcdn-apple-com): Apple's host for macOS update downloads. Big transfers from it are macOS updates.
- [*.cdn-apple.com](https://kilobat.app/hosts/cdn-apple-com): An Apple content delivery domain. Apple lists it for iCloud services; update and sign-in hosts sit under it too.
- [mesu.apple.com](https://kilobat.app/hosts/mesu-apple-com): Apple's host for software update catalogs, the lists of updates that devices check against.
- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot)