2

Ever since I have installed a Pi-hole DNS/DHCP server at my home, I see the host xp.apple.com pop up as one of the most blocked hosts. The amount of lookups attempted is ridiculous, at around 10% of all DNS lookups combined, even eclipsing graph.facebook.com, which is usually the worst offender.

Hence my question: what is xp.apple.com for and what kind of data is sent there. I am aware of Apple's server connection information but there's no mention of what kind of data is transferred. Also, several internet searches did not bring any more info about it to light.

Improve this question

2 Answers 2

Reset to default
3

It seems to be related to the app store and os updates. All my apple devices attempt to connect to it during updates. On MacOS the processes which attempt connection are commerce, appstoreagent, rtcreportingd and App Store.

I would speculate that it is for some kind of telemetry, as I have had it blocked for a couple of months now and it has never caused any updates to fail. I suspect the same is true for configuration.apple.com .

Improve this answer
1
2

They mention it, but they do not provide details: https://support.apple.com/en-us/HT210060

Software updates

Make sure you can access the following ports for updating macOS, apps from the Mac App Store, and for using content caching.

macOS, iOS, iPadOS, watchOS, and tvOS

Apple devices need access to the following hosts when installing, restoring, and updating iOS, iPadOS, macOS, watchOS, and tvOS.

Hosts Ports Protocol OS Description Supports proxies
[...]
xp.apple.com 443 TCP iOS, iPadOS, tvOS, and macOS   Yes

https://support.apple.com/en-us/HT201999 (archived, June 12 2020) (current)

About macOS, iOS, and iTunes server host connections and iTunes background processes

Some Apple software, including macOS, iOS, and iTunes, uses different ports and servers to connect to various services. iTunes for Windows also installs some processes that run in the background when the software is open.

Make sure that your security software is set up correctly. Setup steps vary by software, so contact the developer for specifics.

On Mac, applications signed by Apple automatically receive incoming connections. This article doesn't apply if you're using the macOS built-in Application Firewall.

Server connections

The following servers are used by macOS, iOS, and iTunes:

Apple servers

albert.apple.com, appldnld.apple.com, configuration.apple.com, .cdn-apple.com, deimos3.apple.com, gg.apple.com, gs.apple.com, itunes.apple.com, *.itunes.apple.com, mesu.apple.com, *.mzstatic.com, skl.apple.com, swscan.apple.com, xp.apple.com

Other servers

evintl-ocsp.verisign.com, evsecure-ocsp.verisign.com, *.amazonaws.com, *.digicert.com, *.symcb.com, *.symcd.com

Improve this answer
1
  • Thanks for the answer! If you think you can substantially improve an existing answer, also consider using the edit function. There’s no harm at all with trying a couple edits as high reputation people on the site will review them. Just be sure you make your answer stand alone and give credit to another answer if you copy some - that’s perfectly allowed by the CC license here.
    – bmike ♦
    Commented May 26, 2020 at 1:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .