# NSExceptionDomains Custom App Transport Security (ATS) configurations for named domains. ## Discussion The value for this key is a dictionary with keys that name specific domains, IP addresses, or IP address ranges for which you want to set exceptions. The value for each domain key is another dictionary that indicates the exceptions for that domain. ```console NSExceptionDomains : Dictionary { : Dictionary { NSIncludesSubdomains : Boolean NSExceptionAllowsInsecureHTTPLoads : Boolean NSExceptionMinimumTLSVersion : String NSExceptionRequiresForwardSecrecy : Boolean } } ``` Follow these rules when setting a domain name string: - **Use lowercase** — Use `example.com`, not `EXAMPLE.COM`. - **Use a DNS domain name, IP address, or range of IP addresses** — In iOS 17, iPadOS 17, and macOS 14, you can use an IPv4 address, for example `192.168.42.63`, or an IPv6 address, for example `2001:db8:12::34`. You can also use a classless inter-domain routing (CIDR) range, for example `2001:db8:12::/48`. For information about how ATS handles IP addresses, see [`NSAllowsLocalNetworking`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsLocalNetworking). > Note: > If you exclude a DNS domain name and your app contacts a host by IP address, the ATS exclusion for the domain name doesn’t apply to the connection even if a DNS query for the domain name would resolve to the IP address. If you exclude an IP address and your app contacts a host by DNS name that resolves to that IP address, the ATS exclusion for the IP address doesn’t apply to the connection. - **Don’t include a port number** — Use `example.com`, not `example.com:443`. - **Don’t include a trailing dot, unless you only want to match a domain string with a trailing dot** — For example, `example.com.` (with a trailing dot) matches “example.com.” but not “example.com”. Similarly, `example.com` matches “example.com” but not “example.com.”. - **Don’t use wildcard domains** — Don’t use `*.example.com`. Instead, use `example.com` and set [`NSIncludesSubdomains`](/documentation/BundleResources/Information-Property-List/NSIncludesSubdomains) to `YES`. The values for the keys in each individual domain’s dictionary control how ATS treats connections made to that domain. > Note: > If you specify an exception domain dictionary, ATS ignores any global configuration keys, like ``doc://com.apple.bundleresources/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoads``, for that domain. This is true even if you leave the domain-specific dictionary empty and rely entirely on its keys’ default values. ## Topics ### Subdomains [`NSIncludesSubdomains`](/documentation/BundleResources/Information-Property-List/NSIncludesSubdomains) A Boolean value that indicates whether to extend the configuration to subdomains of the given domain. ### Exceptions [`NSExceptionAllowsInsecureHTTPLoads`](/documentation/BundleResources/Information-Property-List/NSExceptionAllowsInsecureHTTPLoads) A Boolean value indicating whether to allow insecure HTTP loads. [`NSExceptionMinimumTLSVersion`](/documentation/BundleResources/Information-Property-List/NSExceptionMinimumTLSVersion) The minimum Transport Layer Security (TLS) version for network connections. [`NSExceptionRequiresForwardSecrecy`](/documentation/BundleResources/Information-Property-List/NSExceptionRequiresForwardSecrecy) A Boolean value indicating whether to override the perfect forward secrecy requirement. [`NSRequiresCertificateTransparency`](/documentation/BundleResources/Information-Property-List/NSRequiresCertificateTransparency) An obsolete Boolean value indicating whether to require Certificate Transparency. [`NSExceptionRequiresNIAPTLSPackageVersion`](/documentation/BundleResources/Information-Property-List/NSExceptionRequiresNIAPTLSPackageVersion) A string that indicates the version to use for the NIAP Functional Package for TLS, applied to an exception domain. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)