Use Apple products on enterprise networks
Learn which hosts and ports are required to use your Apple products on enterprise networks.
This article is intended for enterprise and education network administrators.
Apple products require access to the internet hosts in this article for a variety of services. Here's how your devices connect to hosts and work with proxies:
Network connections to the hosts below are initiated by the device, not by hosts operated by Apple.
Apple services will fail any connection that uses HTTPS Interception (SSL Inspection). If the HTTPS traffic traverses a web proxy, disable HTTPS Interception for the hosts listed in this article.
Make sure your Apple devices can access the hosts listed below.
Apple Push Notifications
Learn how to troubleshoot connecting to the Apple Push Notification service (APNs). For devices that send all traffic through an HTTP proxy, you can configure the proxy either manually on the device or with Mobile Device Management (MDM). Devices can connect to APNs when configured to use the HTTP proxy with a proxy auto-config (PAC) file.
Device setup
Apple devices need access to the following hosts during setup, or when installing, updating, or restoring the operating system.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
albert.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Device activation | Yes |
captive.apple.com | 443, 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Internet connectivity validation for networks that use captive portals | Yes |
gs.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Yes | |
humb.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Yes | |
static.ips.apple.com | 443, 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Yes | |
sq-device.apple.com | 443 | TCP | iOS, iPadOS, and visionOS | eSIM activation | — |
tbsc.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Yes | |
time-ios.apple.com | 123 | UDP | iOS, iPadOS, tvOS, and visionOS | Used by devices to set their date and time | — |
time.apple.com | 123 | UDP | iOS, iPadOS, tvOS, macOS, and visionOS | Used by devices to set their date and time | — |
time-macos.apple.com | 123 | UDP | macOS only | Used by devices to set their date and time | — |
Device management
Apple devices enrolled in MDM need access to the following hosts and domains.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
*.push.apple.com | 443, 80, 5223, 2197 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Push notifications | |
deviceenrollment.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | DEP provisional enrollment | — |
deviceservices-external.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | — | |
gdmf.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | Used by an MDM server to identify which software updates are available to devices that use managed software updates | Yes |
identity.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | APNs certificate request portal | Yes |
iprofiles.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | Hosts enrollment profiles used when devices enroll in Apple School Manager or Apple Business Manager through Device Enrollment | Yes |
mdmenrollment.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | MDM servers to upload enrollment profiles used by clients enrolling through Device Enrollment in Apple School Manager or Apple Business Manager, and to look up devices and accounts | Yes |
setup.icloud.com | 443 | TCP | iOS and iPadOS | Required to log in to a Managed Apple Account on Shared iPad | — |
vpp.itunes.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | MDM servers to perform operations related to Apps and Books, like assigning or revoking licenses on a device | Yes |
*.appattest.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Managed device attestation | — |
Apple Business Manager and Apple School Manager
Administrators and managers
Administrators and managers need access to the following hosts and domains in order to administer and manage Apple Business Manager and Apple School Manager.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
*.business.apple.com | 443, 80 | TCP | - | Apple Business Manager | — |
*.school.apple.com | 443, 80 | TCP | - | Apple School Manager | — |
appleid.cdn-apple.com | 443 | TCP | - | Login authentication | Yes |
idmsa.apple.com | 443 | TCP | - | Login authentication | Yes |
*.itunes.apple.com | 443, 80 | TCP | - | Apps and Books | Yes |
*.mzstatic.com | 443 | TCP | - | Apps and Books | — |
api.ent.apple.com | 443 | TCP | - | Apps and Books (ABM) | — |
api.edu.apple.com | 443 | TCP | - | Apps and Books (ASM) | — |
statici.icloud.com | 443 | TCP | - | Device icons | — |
*.vertexsmb.com | 443 | TCP | - | Validating tax-exempt status | — |
www.apple.com | 443 | TCP | - | Fonts for certain languages | — |
upload.appleschoolcontent.com | 22 | SSH | - | SFTP uploads | Yes |
Schools that use Claris Connect to sync their supported Student Information System (SIS) to Apple School Manager and upload OneRoster files must also allow access to Claris Connect hosts.
Employees and students
Employees and students using Managed Apple Accounts need access to the following host in order to look up others in their business or school when composing messages or sharing documents.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
ws-ee-maidsvc.icloud.com | 443, 80 | TCP | iOS, iPadOS, macOS, and visionOS | User lookup service | — |
Apple Business Essentials device management
Administrators and devices managed by Apple Business Essentials need access to the following hosts and domains, along with those listed above for Apple Business Manager.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
axm-adm-enroll.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | DEP enrollment server | — |
axm-adm-mdm.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | MDM server | — |
axm-adm-scep.apple.com | 443 | TCP | iOS, iPadOS, tvOS, and macOS | SCEP server | — |
axm-app.apple.com | 443 | TCP | iOS, iPadOS, and macOS | View and manage apps and devices | — |
*.apple-mapkit.com | 443 | TCP | iOS and iPadOS | View the location of devices in Managed Lost Mode | — |
icons.axm-usercontent-apple.com | 443 | TCP | macOS | Custom Package icons | — |
Classroom and Schoolwork
Student and Teacher devices using the Classroom or Schoolwork apps need access to the following hosts, as well as those listed in the Apple Account and iCloud sections below.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
s.mzstatic.com | 443 | TCP | iPadOS and macOS | Classroom and Schoolwork device verification | — |
play.itunes.apple.com | 443 | TCP | iPadOS and macOS | Classroom and Schoolwork device verification | — |
ws-ee-maidsvc.icloud.com | 443 | TCP | iPadOS and macOS | Classroom and Schoolwork class roster service | — |
ws.school.apple.com | 443 | TCP | iPadOS and macOS | Classroom and Schoolwork class roster service | — |
pg-bootstrap.itunes.apple.com | 443 | TCP | iPadOS | Schoolwork handout service | — |
cls-iosclient.itunes.apple.com | 443 | TCP | iPadOS | Schoolwork handout service | — |
cls-ingest.itunes.apple.com | 443 | TCP | iPadOS | Schoolwork handout service | — |
Software updates
Apple devices need access to the following hosts when installing, restoring, and updating iOS, iPadOS, macOS, watchOS, tvOS, and visionOS.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
appldnld.apple.com | 80 | TCP | iOS, iPadOS, watchOS, and visionOS | iOS, iPadOS, and watchOS updates | — |
configuration.apple.com | 443 | TCP | macOS only | Rosetta 2 updates | — |
gdmf.apple.com | 443 | TCP | iOS, iPadOS, tvOS, watchOS, and macOS | Software update catalog | — |
gg.apple.com | 443, 80 | TCP | iOS, iPadOS, tvOS, watchOS, macOS, and visionOS | iOS, iPadOS, tvOS, watchOS, and macOS updates | Yes |
gs.apple.com | 443, 80 | TCP | iOS, iPadOS, tvOS, watchOS, macOS, and visionOS | iOS, iPadOS, tvOS, watchOS, and macOS updates | Yes |
ig.apple.com | 443 | TCP | macOS only | macOS updates | Yes |
mesu.apple.com | 443, 80 | TCP | iOS, iPadOS, tvOS, watchOS, macOS, and visionOS | Hosts software update catalogs | — |
ns.itunes.apple.com | 443 | TCP | iOS, iPadOS, watchOS, and visionOS | Yes | |
oscdn.apple.com | 443, 80 | TCP | macOS only | macOS Recovery | — |
osrecovery.apple.com | 443, 80 | TCP | macOS only | macOS Recovery | — |
skl.apple.com | 443 | TCP | macOS only | macOS updates | — |
swcdn.apple.com | 443, 80 | TCP | macOS only | macOS updates | — |
swdist.apple.com | 443 | TCP | macOS only | macOS updates | — |
swdownload.apple.com | 443, 80 | TCP | macOS only | macOS updates | Yes |
swscan.apple.com | 443 | TCP | macOS only | macOS updates | — |
updates-http.cdn-apple.com | 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Software update downloads | — |
updates.cdn-apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Software update downloads | — |
xp.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Yes |
Apps and additional content
Apple devices need access to the following hosts and domains for installing and updating apps, using certain app features, and downloading additional content. Some additional content might also be hosted on third-party content distribution networks.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
*.itunes.apple.com | 443, 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Store content such as apps, books, and music | Yes |
*.apps.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Store content such as apps, books, and music | Yes |
*.mzstatic.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Store content such as apps, books, and music, and apps from websites and alternative marketplaces | — |
itunes.apple.com | 443, 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Yes | |
ppq.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Enterprise App validation | — |
api.apple-cloudkit.com | 443 | TCP | macOS | App notarization | — |
*.appattest.apple.com | 443 | TCP | iOS, iPadOS, macOS, and visionOS | App validation, Touch ID and Face ID authentication for websites | — |
*.apps-marketplace.apple.com | 443 | TCP | iOS | Installing apps from websites and alternative marketplaces | Yes |
token.safebrowsing.apple.com | 443 | TCP | iOS, iPadOS, macOS, and visionOS | Safari fraudulent website warnings | __ |
audiocontentdownload.apple.com | 80, 443 | TCP | iOS, iPadOS, and macOS | GarageBand downloadable content | — |
devimages-cdn.apple.com | 80, 443 | TCP | macOS | Xcode downloadable components | — |
download.developer.apple.com | 80, 443 | TCP | macOS | Xcode downloadable components | — |
playgrounds-assets-cdn.apple.com | 443 | TCP | iPadOS and macOS | Swift Playgrounds | — |
playgrounds-cdn.apple.com | 443 | TCP | iPadOS and macOS | Swift Playgrounds | — |
sylvan.apple.com | 80, 433 | TCP | tvOS and macOS | Aerial screen savers and wallpaper | — |
gateway.icloud.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Voice Control assets | — |
Carrier updates
Cellular devices need access to the following hosts to install carrier bundle updates.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
appldnld.apple.com | 80 | TCP | iOS and iPadOS | Cellular carrier bundle updates | — |
appldnld.apple.com.edgesuite.net | 80 | TCP | iOS and iPadOS | Cellular carrier bundle updates | — |
itunes.com | 80 | TCP | iOS and iPadOS | Carrier bundle update discovery | — |
itunes.apple.com | 443 | TCP | iOS and iPadOS | Carrier bundle update discovery | — |
updates-http.cdn-apple.com | 80 | TCP | iOS and iPadOS | Cellular carrier bundle updates | — |
updates.cdn-apple.com | 443 | TCP | iOS and iPadOS | Cellular carrier bundle updates | — |
Content caching
A Mac that provides content caching needs access to the following hosts, as well as the hosts listed in this document that provide Apple content such as software updates, apps, and additional content.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
lcdn-registration.apple.com | 443 | TCP | macOS | Server registration | Yes |
suconfig.apple.com | 80 | TCP | macOS | Configuration | — |
xp-cdn.apple.com | 443 | TCP | macOS | Reporting | Yes |
Clients of macOS content caching need access to the following hosts.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
lcdn-locator.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Content caching locator service | — |
serverstatus.apple.com | 443 | TCP | macOS | Content caching client public IP determination | — |
Beta updates
Apple devices need access to the following hosts to sign in to Beta Updates and report feedback using the Feedback Assistant app.
Hosts | Port | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
bpapi.apple.com | 443 | TCP | iOS, iPadOS, tvOS, watchOS, macOS, and visionOS | Beta update enrollment | Yes |
cssubmissions.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Used by Feedback Assistant to upload files | Yes |
fba.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Used by Feedback Assistant to file and view feedback | Yes |
Apple diagnostics
Apple devices might access the following host in order to perform diagnostics used to detect a possible hardware issue.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
diagassets.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Used by Apple devices to help detect possible hardware issues | Yes |
Domain Name System resolution
Encrypted Domain Name System (DNS) resolution in iOS 14, iPadOS 14, tvOS 14, and macOS Big Sur and later uses the following host.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
doh.dns.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Used for DNS over HTTPS (DoH) | Yes |
Certificate validation
Apple devices must be able to connect to the following hosts to validate digital certificates used by the hosts in this article.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
certs.apple.com | 80, 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | — |
crl.apple.com | 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | — |
crl3.digicert.com | 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | — |
crl4.digicert.com | 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | — |
ocsp.apple.com | 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | — |
ocsp.digicert.cn | 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation in China | — |
ocsp.digicert.com | 80 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | — |
ocsp2.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | — |
valid.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Certificate validation | Yes |
Apple Account
Apple devices must be able to connect to the following hosts in order to authenticate an Apple Account. This is required for all services that use an Apple Account, such as iCloud, app installation, and Xcode.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
account.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Apple Account authentication in Settings and System Preferences | Yes |
appleid.cdn-apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Apple Account authentication in Settings and System Preferences | Yes |
idmsa.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Apple Account authentication | Yes |
gsa.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | Apple Account authentication | Yes |
iCloud
In addition to the Apple Account hosts listed above, Apple devices must be able to connect to hosts in the following domains to use iCloud services.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
*.apple-cloudkit.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services | — |
*.apple-livephotoskit.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services | — |
*.apzones.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services in China | — |
*.cdn-apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services | — |
*.gc.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services | — |
*.icloud.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services | — |
*.icloud.com.cn | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services in China | — |
*.icloud.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services | — |
*.icloud-content.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iCloud services | — |
*.iwork.apple.com | 443 | TCP | iOS, iPadOS, tvOS, macOS, and visionOS | iWork documents | — |
mask.icloud.com | 443 | UDP | iOS, iPadOS, macOS, and visionOS | iCloud Private Relay | — |
mask-h2.icloud.com | 443 | TCP | iOS, iPadOS, macOS, and visionOS | iCloud Private Relay | — |
mask-api.icloud.com | 443 | TCP | iOS, iPadOS, macOS, and visionOS | iCloud Private Relay | Yes |
Apple Intelligence, Siri, and Search
Apple devices must be able to connect to the following hosts to process Apple Intelligence requests that use Private Cloud Compute and to process Siri requests, including dictation and searching in Apple apps.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
guzzoni.apple.com | 443 | TCP | iOS, iPadOS, macOS, and visionOS | Siri and dictation requests | — |
*.smoot.apple.com | 443 | TCP | iOS, iPadOS, macOS, and visionOS | Search services, including Siri, Spotlight, Lookup, Safari, News, Messages, and Music | — |
apple-relay.cloudflare.com | 443 | TCP, UDP | iOS, iPadOS, and macOS | Private Cloud Compute | — |
apple-relay.fastly-edge.com | 443 | TCP, UDP | iOS, iPadOS, and macOS | Private Cloud Compute | — |
cp4.cloudflare.com | 443 | TCP, UDP | iOS, iPadOS, and macOS | Private Cloud Compute | — |
apple-relay.apple.com | 443 | TCP, UDP | iOS, iPadOS, and macOS | Apple Intelligence Extensions | — |
Associated Domains
Apple devices must be able to connect to the following hosts to use Associated Domains in iOS 14, iPadOS 14, and macOS Big Sur and later. Associated Domains underpin universal links, a feature that allows an app to present content in place of all or part of its website. Handoff, App Clips, and single sign-on extensions all use Associated Domains.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
app-site-association.cdn-apple.com | 443 | TCP, UDP | iOS, iPadOS, macOS, and visionOS | Associated domains for universal links | — |
app-site-association.networking.apple | 443 | TCP, UDP | iOS, iPadOS, macOS, and visionOS | Associated domains for universal links | — |
Tap to Pay on iPhone
To use a payment app to accept contactless payments, an iPhone must be able to reach the following hosts.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
pos-device.apple.com | 443 | TCP, UDP | iOS | Tap to Pay on iPhone | Yes |
humb.apple.com | 443 | TCP | iOS | Tap to Pay on iPhone setup | Yes |
phonesubmissions.apple.com | 443 | TCP | iOS | Optional analytics sharing | Yes |
ID Verifier on iPhone
To use an ID Verifier-enabled app to accept mobile IDs, an iPhone must be able to reach the following hosts.
Hosts | Ports | Protocol | OS | Description | Supports proxies |
|---|---|---|---|---|---|
smp-device-content.apple.com | 443 | TCP | iOS | ID Verifier on iPhone | Yes |
idv.cdn-apple.com | 443 | TCP | iOS | ID Verifier on iPhone | Yes |
idv-prod1.apple.com | 443 | TCP | iOS | ID Verifier on iPhone | Yes |
humb.apple.com | 443 | TCP | iOS | ID Verifier on iPhone | Yes |
Firewalls
If your firewall supports using hostnames, you might be able to use most Apple services above by allowing outbound connections to *.apple.com. If your firewall can only be configured with IP addresses, allow outbound connections to 17.0.0.0/8. The entire 17.0.0.0/8 address block is assigned to Apple.
HTTP proxy
You can use Apple services through a proxy if you disable packet inspection and authentication for traffic to and from the listed hosts. Exceptions to this are noted above. Attempts to perform content inspection on encrypted communications between Apple devices and services will result in a dropped connection to preserve platform security and user privacy.
Content Distribution Networks and DNS Resolution
Some of the hosts listed in this article may have CNAME records in DNS instead of A or AAAA records. These CNAME records may refer to other CNAME records in a chain before ultimately resolving to an IP address. This DNS resolution allows Apple to provide fast and reliable content delivery to users in all regions and is transparent to devices and proxy servers. Apple doesn't publish a list of these CNAME records because they are subject to change. You shouldn't need to configure your firewall or proxy server to allow them as long as you don't block DNS lookups and allow access to the hosts and domains named above.
Recent changes
October 2024: Added information about Apple Intelligence Extensions.
September 2024: Updated for Apple Account, added information for Claris Connect, and updated the Certificate Validation section.
June 2024: Added information about Private Cloud Compute.
April 2024: Added information for visionOS, ID Verifier on iPhone, and alternative marketplaces. Reorganized tables for Software Updates and combined App Store and App features tables into a new Apps and additional content table.
July 2023: Removed the macOS version requirement for APN connection.
Learn more
See a list of TCP and UDP ports used by Apple software products.
