🔒Mail App Contacts iCloud on Non-iCloud Email Sends
Your Mail app is talking to Apple even when it shouldn't
TL;DR
The iOS Mail app secretly contacts iCloud servers during non-iCloud email sends, bypassing privacy tools. This behavior raises questions about data collection and security.
When you send an email from a non-iCloud account on the iOS Mail app, it unexpectedly reaches out to iCloud's servers at gateway.icloud.com over TCP and UDP protocols. The app uses certificate pinning to prevent analysis with tools like Proxyman or network extensions. This behavior has been observed in multiple tests, making it clear that Apple is collecting data even when you're not using iCloud for email storage. Developers working on privacy-focused apps need to be aware of this hidden connection.
Key Points
Mail app connects to https://gateway.icloud.com:443/ckdatabase/api/client/query/retrieve when sending emails.
nsurlsessiond process attempts connection to https://gateway.icloud.com:443/ckdatabase/api/client/record/save during email sends.
Certificate pinning blocks analysis with Proxyman or network extensions, making it hard to track data flow.
Little Snitch rules can block cloudd and nsurlsessiond from connecting to gateway.icloud.com for testing purposes.
Apple's Mail app queries CloudKit even when iCloud is disabled for email storage.
Why It Matters
If you're building a privacy-focused email client or auditing network traffic, this behavior by the iOS Mail app could be a red flag. Developers need to account for unexpected data collection and ensure their apps don't inadvertently leak user information.
Frequently Asked Questions
Why does this matter?
If you're building a privacy-focused email client or auditing network traffic, this behavior by the iOS Mail app could be a red flag. Developers need to account for unexpected data collection and ensure their apps don't inadvertently leak user information.
What happened?
The iOS Mail app secretly contacts iCloud servers during non-iCloud email sends, bypassing privacy tools. This behavior raises questions about data collection and security.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.