apple_allow

gistfile1.txt

# Apple Services Allowlist
# Source: https://support.apple.com/en-us/101555
# Last synced: April 2026
# Excluded: doh.dns.apple.com (DNS bypass), metrics.icloud.com (telemetry),
#           iphonesubmissions.apple.com (optional analytics)

# Device Setup
albert.apple.com
captive.apple.com
gs.apple.com
humb.apple.com
static.ips.apple.com
sq-device.apple.com
tbsc.apple.com
time-ios.apple.com
time.apple.com
time-macos.apple.com

# Device Management
*.push.apple.com
deviceenrollment.apple.com
deviceservices-external.apple.com
gdmf.apple.com
identity.apple.com
iprofiles.apple.com
mdmenrollment.apple.com
setup.icloud.com
vpp.itunes.apple.com
*.appattest.apple.com
axm-servicediscovery.apple.com

# Apple Business and School Manager
*.business.apple.com
*.school.apple.com
appleid.cdn-apple.com
idmsa.apple.com
api.ent.apple.com
api.edu.apple.com
statici.icloud.com
*.vertexsmb.com
www.apple.com
upload.appleschoolcontent.com
api-business.apple.com
api-school.apple.com
ws-ee-maidsvc.icloud.com

# Apple Business Device Management
axm-adm-enroll.apple.com
axm-adm-mdm.apple.com
axm-adm-scep.apple.com
axm-app.apple.com
*.apple-mapkit.com
icons.axm-usercontent-apple.com

# Classroom and Schoolwork
s.mzstatic.com
play.itunes.apple.com
ws.school.apple.com
pg-bootstrap.itunes.apple.com
cls-iosclient.itunes.apple.com
cls-ingest.itunes.apple.com

# Software Updates
appldnld.apple.com
configuration.apple.com
gg.apple.com
ig.apple.com
mesu.apple.com
oscdn.apple.com
osrecovery.apple.com
skl.apple.com
swcdn.apple.com
swdist.apple.com
swdownload.apple.com
swscan.apple.com
updates-http.cdn-apple.com
updates.cdn-apple.com
xp.apple.com
gdmf-ados.apple.com
gsra.apple.com
wkms-public.apple.com
fcs-keys-pub-prod.cdn-apple.com

# Apps and Content
*.itunes.apple.com
*.apps.apple.com
*.mzstatic.com
itunes.apple.com
ppq.apple.com
api.apple-cloudkit.com
*.apps-marketplace.apple.com
token.safebrowsing.apple
audiocontentdownload.apple.com
devimages-cdn.apple.com
download.developer.apple.com
playgrounds-assets-cdn.apple.com
playgrounds-cdn.apple.com
sylvan.apple.com
gateway.icloud.com

# Carrier Updates
appldnld.apple.com.edgesuite.net
itunes.com

# Content Caching
lcdn-registration.apple.com
suconfig.apple.com
xp-cdn.apple.com
lcdn-locator.apple.com
serverstatus.apple.com

# Beta Updates
bpapi.apple.com
cssubmissions.apple.com
fba.apple.com

# Apple Diagnostics
diagassets.apple.com

# Certificate Validation (required for all Apple services)
certs.apple.com
crl.apple.com
crl3.digicert.com
crl4.digicert.com
ocsp.apple.com
ocsp.digicert.cn
ocsp.digicert.com
ocsp2.apple.com
valid.apple.com

# Apple Account
account.apple.com
gsa.apple.com

# iCloud
*.apple-cloudkit.com
*.apple-livephotoskit.com
*.apzones.com
*.cdn-apple.com
*.gc.apple.com
*.icloud.com
*.icloud.com.cn
*.icloud.apple.com
*.icloud-content.com
*.iwork.apple.com
probe.icloud.com
pong.icloud.com
apple-native-relay.apple.com

# iCloud Private Relay - REVIEW BEFORE ENABLING
# These allow Private Relay which routes traffic around your local DNS filtering.
# If you want to enforce DNS filtering on all devices remove these three entries.
mask.icloud.com
mask-h2.icloud.com
mask-api.icloud.com

# Apple Intelligence, Siri, and Search
guzzoni.apple.com
*.smoot.apple.com
apple-relay.cloudflare.com
apple-relay.fastly-edge.com
cp4.cloudflare.com
apple-relay.apple.com

# Associated Domains (universal links, Handoff, App Clips, SSO)
app-site-association.cdn-apple.com
app-site-association.networking.apple

# Tap to Pay
pos-device.apple.com

# ID Verifier
smp-device-content.apple.com
idv.cdn-apple.com
idv-prod1.apple.com