A curated Little Snitch rule group that blocks 575 telemetry domains across Apple and Microsoft while preserving system updates, authentication, and app-store access.
What it blocks · What's preserved · Installation · Details · License
Why this exists:
Existing blocklists are either too aggressive (blocking
gdmf.apple.comandswscan.apple.com, which breaks system updates) or too narrow (missing most of Microsoft's telemetry surface). I built this to cover 575 domains across 43 rules, cross-referenced against three upstream sources and Apple's enterprise documentation. Tested on Little Snitch 6.4.1+.
What it does:
Blocks Apple and Microsoft telemetry, advertising, crash reporting, and analytics at the network level using a Little Snitch rule group — while deliberately preserving the hosts your Mac needs for updates, authentication, and the App Store. Ships as a subscribable rule group, a backup file, and a plain-text domain list for DNS-level filtering.
| Category | Details |
|---|---|
| Apple Primary Telemetry | xp, pancake, metrics, diagnostics, configuration, gs |
| Apple Additional | smoot, apsu, basejumper, cl1–5, configuration.ls, ssl, ess |
| Apple iAd & Ads | iad, iadsdk, adservices, adattribution, searchads, qwapi |
| Apple Location | gsp, gs-loc, ls, cdn-ls, iphone-ld, guzzoni |
| Apple Crash & Diagnostics | crash-report, diagnostic-log, diagnostics-reports, spindump, sysdiagnose |
| Apple AI / Intelligence | apple-ai, machinelearning, ml-api, mlsrv |
| iCloud (unused) | Sync, Find My, iMessage push, News, TV, Music, Books, Podcasts, Weather, Wallet, Keychain, iCloud Drive |
| Microsoft Full Stack | Windows telemetry (vortex, watson, telecommand), Office/365, Teams, Skype, Bing, Edge, MSN, Azure Service Bus, CDN, Aria, Traffic Manager |
| Spotify | Ad/tracking (adclick, adeventtracker, spads, analytics, heads-ec) |
| WhatsApp / Meta | Analytics, graph.facebook.com, pixel.facebook.com, tr.facebook.com |
| Brave | P3A telemetry, crash reporting |
| Third-Party Crash | Crashlytics, Buglife, Bitwarden events |
Process-level blocks: analyticsd, ecosystemanalyticsd, diagnosticd, wifianalyticsd, inputanalyticsd, audioanalyticsd, geoanalyticsd, symptomsd, SubmitDiagInfo, osanalyticshelper, Microsoft Error Reporting, Office Licensing
| Service | Domains |
|---|---|
| macOS Updates | swscan, gdmf, mesu, appldnld, swcdn, updates-http.cdn-apple.com |
| Apple ID Auth | appleid.apple.com, idmsa.apple.com |
| OCSP / Cert Validation | ocsp.apple.com, crl.apple.com, valid.apple.com |
| App Store / iTunes | apps.apple.com, itunes.apple.com, mzstatic.com |
| Time & Captive Portal | time.apple.com, captive.apple.com |
| Microsoft Updates & Auth | officecdn.microsoft.com, update.microsoft.com, login.microsoftonline.com |
| Brave Updates | laptop-updates.brave.com |
Deliberately unblocked — msn.com parent (too broad), spclient.wg.spotify.com (breaks playback), mmg.whatsapp.net (media delivery), VS Code updates, Bitwarden vault, Telegram infra.
Little Snitch → Rule Group → Subscribe...
Point to subscription.lsrules. Auto-updates on change.
Little-Snitch-Telemetry-Block.lsbackup — File → Import from Backup. Restores all rules including process-level blocks and priority.
blocklist.txt — copy domains into Pi-hole, NextDNS, or a hosts file.
Post-import: drag the telemetry rules above the macOS Services allow group. All deny rules are priority: high so they override default allows, but order still matters in edge cases.
- 575 domains, 43 rules
- All deny:
priority: high,direction: outgoing - Process rules:
identifier.APPLE/codes or full paths - Little Snitch only — no
launchctl disable rules-reference.lsrules— full rules array (build source, not importable via LS UI)subscription.lsrules— compact format for rule group subscriptionsblocklist.txt— plain text domain list
| Source | Domains | Notes |
|---|---|---|
| cedws/apple-telemetry | 1,084 | Primary upstream |
| sifex/apple-telemetry-block.lsrules | 10 | LS-format reference |
| aimarketingflow/macOS-telemetry-blocker | — | Additional macOS domains |
| Apple enterprise documentation | — | Verified against official host list |
- Little Snitch: 6.4.1+
MIT © 2026 JD Cordero