Use Apple products on enterprise networks

Learn which hosts and ports are required to use your Apple products on enterprise networks.

This article is intended for enterprise and education network administrators.

Apple products require access to the internet hosts in this article for a variety of services. Here's how your devices connect to hosts and work with proxies:

  • Network connections to the hosts below are initiated by the device, not by hosts operated by Apple.

  • Apple services will fail any connection that uses HTTPS Interception (SSL Inspection). If the HTTPS traffic traverses a web proxy, disable HTTPS Interception for the hosts listed in this article.

Make sure your Apple devices can access the hosts listed below.

Apple Push Notifications

Learn how to troubleshoot connecting to the Apple Push Notification service (APNs). For devices that send all traffic through an HTTP proxy, you can configure the proxy either manually on the device or with Mobile Device Management (MDM). Devices can connect to APNs when configured to use the HTTP proxy with a proxy auto-config (PAC) file.

Device setup

Apple devices need access to the following hosts during setup, or when installing, updating, or restoring the operating system.

Hosts

Ports

Protocol

OS

Description

Supports proxies

albert.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Device activation

Yes

captive.apple.com

443, 80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Internet connectivity validation for networks that use captive portals

Yes

gs.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Yes

humb.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Yes

static.ips.apple.com

443, 80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Yes

sq-device.apple.com

443

TCP

iOS, iPadOS, and visionOS

eSIM activation

tbsc.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Yes

time-ios.apple.com

123

UDP

iOS, iPadOS, tvOS, and visionOS

Used by devices to set their date and time

time.apple.com

123

UDP

iOS, iPadOS, tvOS, macOS, and visionOS

Used by devices to set their date and time

time-macos.apple.com

123

UDP

macOS only

Used by devices to set their date and time

Device management

Apple devices enrolled in MDM need access to the following hosts and domains.

Hosts

Ports

Protocol

OS

Description

Supports proxies

*.push.apple.com

443, 80, 5223, 2197

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Push notifications

Learn more about APNs and proxies.

deviceenrollment.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

DEP provisional enrollment

deviceservices-external.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

gdmf.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

Used by an MDM server to identify which software updates are available to devices that use managed software updates

Yes

identity.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

APNs certificate request portal

Yes

iprofiles.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

Hosts enrollment profiles used when devices enroll in Apple School Manager or Apple Business Manager through Device Enrollment

Yes

mdmenrollment.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

MDM servers to upload enrollment profiles used by clients enrolling through Device Enrollment in Apple School Manager or Apple Business Manager, and to look up devices and accounts

Yes

setup.icloud.com

443

TCP

iOS and iPadOS

Required to log in to a Managed Apple Account on Shared iPad

vpp.itunes.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

MDM servers to perform operations related to Apps and Books, like assigning or revoking licenses on a device

Yes

*.appattest.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Managed device attestation

Apple Business Manager and Apple School Manager

Administrators and managers

Administrators and managers need access to the following hosts and domains in order to administer and manage Apple Business Manager and Apple School Manager.

Hosts

Ports

Protocol

OS

Description

Supports proxies

*.business.apple.com

443, 80

TCP

-

Apple Business Manager

*.school.apple.com

443, 80

TCP

-

Apple School Manager

appleid.cdn-apple.com

443

TCP

-

Login authentication

Yes

idmsa.apple.com

443

TCP

-

Login authentication

Yes

*.itunes.apple.com

443, 80

TCP

-

Apps and Books

Yes

*.mzstatic.com

443

TCP

-

Apps and Books

api.ent.apple.com

443

TCP

-

Apps and Books (ABM)

api.edu.apple.com

443

TCP

-

Apps and Books (ASM)

statici.icloud.com

443

TCP

-

Device icons

*.vertexsmb.com

443

TCP

-

Validating tax-exempt status

www.apple.com

443

TCP

-

Fonts for certain languages

upload.appleschoolcontent.com

22

SSH

-

SFTP uploads

Yes

Schools that use Claris Connect to sync their supported Student Information System (SIS) to Apple School Manager and upload OneRoster files must also allow access to Claris Connect hosts.

Employees and students

Employees and students using Managed Apple Accounts need access to the following host in order to look up others in their business or school when composing messages or sharing documents.

Hosts

Ports

Protocol

OS

Description

Supports proxies

ws-ee-maidsvc.icloud.com

443, 80

TCP

iOS, iPadOS, macOS, and visionOS

User lookup service

Apple Business Essentials device management

Administrators and devices managed by Apple Business Essentials need access to the following hosts and domains, along with those listed above for Apple Business Manager.

Hosts

Ports

Protocol

OS

Description

Supports proxies

axm-adm-enroll.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

DEP enrollment server

axm-adm-mdm.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

MDM server

axm-adm-scep.apple.com

443

TCP

iOS, iPadOS, tvOS, and macOS

SCEP server

axm-app.apple.com

443

TCP

iOS, iPadOS, and macOS

View and manage apps and devices

*.apple-mapkit.com

443

TCP

iOS and iPadOS

View the location of devices in Managed Lost Mode

icons.axm-usercontent-apple.com

443

TCP

macOS

Custom Package icons

Classroom and Schoolwork

Student and Teacher devices using the Classroom or Schoolwork apps need access to the following hosts, as well as those listed in the Apple Account and iCloud sections below.

Hosts

Ports

Protocol

OS

Description

Supports proxies

s.mzstatic.com

443

TCP

iPadOS and macOS

Classroom and Schoolwork device verification

play.itunes.apple.com

443

TCP

iPadOS and macOS

Classroom and Schoolwork device verification

ws-ee-maidsvc.icloud.com

443

TCP

iPadOS and macOS

Classroom and Schoolwork class roster service

ws.school.apple.com

443

TCP

iPadOS and macOS

Classroom and Schoolwork class roster service

pg-bootstrap.itunes.apple.com

443

TCP

iPadOS

Schoolwork handout service

cls-iosclient.itunes.apple.com

443

TCP

iPadOS

Schoolwork handout service

cls-ingest.itunes.apple.com

443

TCP

iPadOS

Schoolwork handout service

Software updates

Apple devices need access to the following hosts when installing, restoring, and updating iOS, iPadOS, macOS, watchOS, tvOS, and visionOS.

Hosts

Ports

Protocol

OS

Description

Supports proxies

appldnld.apple.com

80

TCP

iOS, iPadOS, watchOS, and visionOS

iOS, iPadOS, and watchOS updates

configuration.apple.com

443

TCP

macOS only

Rosetta 2 updates

gdmf.apple.com

443

TCP

iOS, iPadOS, tvOS, watchOS, and macOS

Software update catalog

gg.apple.com

443, 80

TCP

iOS, iPadOS, tvOS, watchOS, macOS, and visionOS

iOS, iPadOS, tvOS, watchOS, and macOS updates

Yes

gs.apple.com

443, 80

TCP

iOS, iPadOS, tvOS, watchOS, macOS, and visionOS

iOS, iPadOS, tvOS, watchOS, and macOS updates

Yes

ig.apple.com

443

TCP

macOS only

macOS updates

Yes

mesu.apple.com

443, 80

TCP

iOS, iPadOS, tvOS, watchOS, macOS, and visionOS

Hosts software update catalogs

ns.itunes.apple.com

443

TCP

iOS, iPadOS, watchOS, and visionOS

Yes

oscdn.apple.com

443, 80

TCP

macOS only

macOS Recovery

osrecovery.apple.com

443, 80

TCP

macOS only

macOS Recovery

skl.apple.com

443

TCP

macOS only

macOS updates

swcdn.apple.com

443, 80

TCP

macOS only

macOS updates

swdist.apple.com

443

TCP

macOS only

macOS updates

swdownload.apple.com

443, 80

TCP

macOS only

macOS updates

Yes

swscan.apple.com

443

TCP

macOS only

macOS updates

updates-http.cdn-apple.com

80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Software update downloads

updates.cdn-apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Software update downloads

xp.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Yes

Apps and additional content

Apple devices need access to the following hosts and domains for installing and updating apps, using certain app features, and downloading additional content. Some additional content might also be hosted on third-party content distribution networks.

Hosts

Ports

Protocol

OS

Description

Supports proxies

*.itunes.apple.com

443, 80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Store content such as apps, books, and music

Yes

*.apps.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Store content such as apps, books, and music

Yes

*.mzstatic.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Store content such as apps, books, and music, and apps from websites and alternative marketplaces

itunes.apple.com

443, 80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Yes

ppq.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Enterprise App validation

api.apple-cloudkit.com

443

TCP

macOS

App notarization

*.appattest.apple.com

443

TCP

iOS, iPadOS, macOS, and visionOS

App validation, Touch ID and Face ID authentication for websites

*.apps-marketplace.apple.com

443

TCP

iOS

Installing apps from websites and alternative marketplaces

Yes

token.safebrowsing.apple.com

443

TCP

iOS, iPadOS, macOS, and visionOS

Safari fraudulent website warnings

__

audiocontentdownload.apple.com

80, 443

TCP

iOS, iPadOS, and macOS

GarageBand downloadable content

devimages-cdn.apple.com

80, 443

TCP

macOS

Xcode downloadable components

download.developer.apple.com

80, 443

TCP

macOS

Xcode downloadable components

playgrounds-assets-cdn.apple.com

443

TCP

iPadOS and macOS

Swift Playgrounds

playgrounds-cdn.apple.com

443

TCP

iPadOS and macOS

Swift Playgrounds

sylvan.apple.com

80, 433

TCP

tvOS and macOS

Aerial screen savers and wallpaper

gateway.icloud.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Voice Control assets

Carrier updates

Cellular devices need access to the following hosts to install carrier bundle updates.

Hosts

Ports

Protocol

OS

Description

Supports proxies

appldnld.apple.com

80

TCP

iOS and iPadOS

Cellular carrier bundle updates

appldnld.apple.com.edgesuite.net

80

TCP

iOS and iPadOS

Cellular carrier bundle updates

itunes.com

80

TCP

iOS and iPadOS

Carrier bundle update discovery

itunes.apple.com

443

TCP

iOS and iPadOS

Carrier bundle update discovery

updates-http.cdn-apple.com

80

TCP

iOS and iPadOS

Cellular carrier bundle updates

updates.cdn-apple.com

443

TCP

iOS and iPadOS

Cellular carrier bundle updates

Content caching

A Mac that provides content caching needs access to the following hosts, as well as the hosts listed in this document that provide Apple content such as software updates, apps, and additional content.

Hosts

Ports

Protocol

OS

Description

Supports proxies

lcdn-registration.apple.com

443

TCP

macOS

Server registration

Yes

suconfig.apple.com

80

TCP

macOS

Configuration

xp-cdn.apple.com

443

TCP

macOS

Reporting

Yes

Clients of macOS content caching need access to the following hosts.

Hosts

Ports

Protocol

OS

Description

Supports proxies

lcdn-locator.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Content caching locator service

serverstatus.apple.com

443

TCP

macOS

Content caching client public IP determination

Beta updates

Apple devices need access to the following hosts to sign in to Beta Updates and report feedback using the Feedback Assistant app.

Hosts

Port

Protocol

OS

Description

Supports proxies

bpapi.apple.com

443

TCP

iOS, iPadOS, tvOS, watchOS, macOS, and visionOS

Beta update enrollment

Yes

cssubmissions.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Used by Feedback Assistant to upload files

Yes

fba.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Used by Feedback Assistant to file and view feedback

Yes

Apple diagnostics

Apple devices might access the following host in order to perform diagnostics used to detect a possible hardware issue.

Hosts

Ports

Protocol

OS

Description

Supports proxies

diagassets.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Used by Apple devices to help detect possible hardware issues

Yes

Domain Name System resolution

Encrypted Domain Name System (DNS) resolution in iOS 14, iPadOS 14, tvOS 14, and macOS Big Sur and later uses the following host.

Hosts

Ports

Protocol

OS

Description

Supports proxies

doh.dns.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Used for DNS over HTTPS (DoH)

Yes

Certificate validation

Apple devices must be able to connect to the following hosts to validate digital certificates used by the hosts in this article.

Hosts

Ports

Protocol

OS

Description

Supports proxies

certs.apple.com

80, 443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

crl.apple.com

80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

crl3.digicert.com

80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

crl4.digicert.com

80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

ocsp.apple.com

80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

ocsp.digicert.cn

80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation in China

ocsp.digicert.com

80

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

ocsp2.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

valid.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Certificate validation

Yes

Apple Account

Apple devices must be able to connect to the following hosts in order to authenticate an Apple Account. This is required for all services that use an Apple Account, such as iCloud, app installation, and Xcode.

Hosts

Ports

Protocol

OS

Description

Supports proxies

account.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Apple Account authentication in Settings and System Preferences

Yes

appleid.cdn-apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Apple Account authentication in Settings and System Preferences

Yes

idmsa.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Apple Account authentication

Yes

gsa.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

Apple Account authentication

Yes

iCloud

In addition to the Apple Account hosts listed above, Apple devices must be able to connect to hosts in the following domains to use iCloud services.

Hosts

Ports

Protocol

OS

Description

Supports proxies

*.apple-cloudkit.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services

*.apple-livephotoskit.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services

*.apzones.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services in China

*.cdn-apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services

*.gc.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services

*.icloud.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services

*.icloud.com.cn

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services in China

*.icloud.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services

*.icloud-content.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iCloud services

*.iwork.apple.com

443

TCP

iOS, iPadOS, tvOS, macOS, and visionOS

iWork documents

mask.icloud.com

443

UDP

iOS, iPadOS, macOS, and visionOS

iCloud Private Relay

mask-h2.icloud.com

443

TCP

iOS, iPadOS, macOS, and visionOS

iCloud Private Relay

mask-api.icloud.com

443

TCP

iOS, iPadOS, macOS, and visionOS

iCloud Private Relay

Yes

Apple Intelligence, Siri, and Search

Apple devices must be able to connect to the following hosts to process Apple Intelligence requests that use Private Cloud Compute and to process Siri requests, including dictation and searching in Apple apps.

Hosts

Ports

Protocol

OS

Description

Supports proxies

guzzoni.apple.com

443

TCP

iOS, iPadOS, macOS, and visionOS

Siri and dictation requests

*.smoot.apple.com

443

TCP

iOS, iPadOS, macOS, and visionOS

Search services, including Siri, Spotlight, Lookup, Safari, News, Messages, and Music

apple-relay.cloudflare.com

443

TCP, UDP

iOS, iPadOS, and macOS

Private Cloud Compute

apple-relay.fastly-edge.com

443

TCP, UDP

iOS, iPadOS, and macOS

Private Cloud Compute

cp4.cloudflare.com

443

TCP, UDP

iOS, iPadOS, and macOS

Private Cloud Compute

Associated Domains

Apple devices must be able to connect to the following hosts to use Associated Domains in iOS 14, iPadOS 14, and macOS Big Sur and later. Associated Domains underpin universal links, a feature that allows an app to present content in place of all or part of its website. Handoff, App Clips, and single sign-on extensions all use Associated Domains.

Hosts

Ports

Protocol

OS

Description

Supports proxies

app-site-association.cdn-apple.com

443

TCP, UDP

iOS, iPadOS, macOS, and visionOS

Associated domains for universal links

app-site-association.networking.apple

443

TCP, UDP

iOS, iPadOS, macOS, and visionOS

Associated domains for universal links

Tap to Pay on iPhone

To use a payment app to accept contactless payments, an iPhone must be able to reach the following hosts.

Hosts

Ports

Protocol

OS

Description

Supports proxies

pos-device.apple.com

443

TCP, UDP

iOS

Tap to Pay on iPhone

Yes

humb.apple.com

443

TCP

iOS

Tap to Pay on iPhone setup

Yes

phonesubmissions.apple.com

443

TCP

iOS

Optional analytics sharing

Yes

ID Verifier on iPhone

To use an ID Verifier-enabled app to accept mobile IDs, an iPhone must be able to reach the following hosts.

Hosts

Ports

Protocol

OS

Description

Supports proxies

smp-device-content.apple.com

443

TCP

iOS

ID Verifier on iPhone

Yes

idv.cdn-apple.com

443

TCP

iOS

ID Verifier on iPhone

Yes

idv-prod1.apple.com

443

TCP

iOS

ID Verifier on iPhone

Yes

humb.apple.com

443

TCP

iOS

ID Verifier on iPhone

Yes

Firewalls

If your firewall supports using hostnames, you might be able to use most Apple services above by allowing outbound connections to *.apple.com. If your firewall can only be configured with IP addresses, allow outbound connections to 17.0.0.0/8. The entire 17.0.0.0/8 address block is assigned to Apple.

HTTP proxy

You can use Apple services through a proxy if you disable packet inspection and authentication for traffic to and from the listed hosts. Exceptions to this are noted above. Attempts to perform content inspection on encrypted communications between Apple devices and services will result in a dropped connection to preserve platform security and user privacy.

Content Distribution Networks and DNS Resolution

Some of the hosts listed in this article may have CNAME records in DNS instead of A or AAAA records. These CNAME records may refer to other CNAME records in a chain before ultimately resolving to an IP address. This DNS resolution allows Apple to provide fast and reliable content delivery to users in all regions and is transparent to devices and proxy servers. Apple doesn't publish a list of these CNAME records because they are subject to change. You shouldn't need to configure your firewall or proxy server to allow them as long as you don't block DNS lookups and allow access to the hosts and domains named above.

Recent changes

September 2024: Updated for Apple Account, added information for Claris Connect, and updated the Certificate Validation section.

June 2024: Added information about Private Cloud Compute.

April 2024: Added information for visionOS, ID Verifier on iPhone, and alternative marketplaces. Reorganized tables for Software Updates and combined App Store and App features tables into a new Apps and additional content table.

July 2023: Removed the macOS version requirement for APN connection

Learn more

See a list of TCP and UDP ports used by Apple software products.

Published Date: