Universal Link Not Working – Apple Request Blocked by Firewall Due to Geographic Restriction

Question

Created 3w

Replies 5

Boosts 0

Participants 2

Hello,

I’m encountering an issue with Universal Links in my iOS app. After some investigation, I found that the root cause seems to be that Apple’s request through there CDN server to access the .well-known/apple-app-site-association file is blocked by our firewall, which enforces geographic access restrictions as part of our security policy.

Because of this restriction, Apple’s validation or link verification requests are being denied, and the Universal Links are not working as expected.

I’d like to get some guidance from the community or Apple engineers on the following: 1. Does Apple provide an official list of IP ranges or domains that need to be allowed through the firewall for Universal Link validation? 2. Are there alternative methods to handle Universal Link verification in environments with geographic restrictions? 3. Would whitelisting specific Apple services or endpoints be a recommended or safe solution?

Any input or recommendations would be greatly appreciated.

Environment Details: • iOS app using Universal Links • Server protected by a firewall with regional restrictions • AASA file hosted correctly and accessible via browser

Thanks in advance for your help and insights.

Answered by DTS Engineer in 865598022

Thank you for your post and question. Regrettably, Apple’s range of IP addresses may change, so we request that you open the range to all IP addresses and user-agents. Blocking regionally will cause issues for users in different regions. Apple does not provide a list of IP addresses.

We put all that in this Tech Note TN3155: Debugging universal links | Apple Developer Documentation

Hope this helps, I know this is not the answer you probably wanted.

Albert Pascual   Worldwide Developer Relations.

Boost

Answer 1

DTS Engineer OP

Apple

3w

Accepted Answer

Thank you for your post and question. Regrettably, Apple’s range of IP addresses may change, so we request that you open the range to all IP addresses and user-agents. Blocking regionally will cause issues for users in different regions. Apple does not provide a list of IP addresses.

We put all that in this Tech Note TN3155: Debugging universal links | Apple Developer Documentation

Hope this helps, I know this is not the answer you probably wanted.

Albert Pascual   Worldwide Developer Relations.

1

Answer 2

ragu2307 OP

3w

Hi Albert,

Thank you for your quick and detailed response — I really appreciate your time and clarification.

I completely understand from your explanation (and Tech Note TN3155) that Apple’s IP ranges are dynamic and that blocking traffic regionally can cause issues with Universal Links.

However, our app is intentionally available only in a specific country, and we’ve already enforced this restriction through App Store country availability settings as per our business requirements. In addition, our cybersecurity team does not allow opening our domain to regions outside of the targeted country for compliance and data-protection reasons.

Given these constraints, I’d like to know if there are any alternative approaches or recommendations Apple could suggest for Universal Link validation in such restricted environments.

Thank you again for your support and guidance.

Best regards,

Raguraman Asokan

0

Answer 3

DTS Engineer OP

Apple

2w

Apologies for the extended delay. I comprehend the geographic restrictions, but your server should permit requests for the AASA file from any IP address and user agent. Without this capability, the AASA file cannot be downloaded and utilized.

Could you please provide a link to the file in question?

Without access to that file from your server, I am unable to identify any alternative methods to obtain access to the Universal Links.

Albert Pascual   Worldwide Developer Relations.

0

Answer 4

ragu2307 OP

2w

Thank you for your response.

Here is the AASA file URL as requested: https://pre-api.tcc-ltd.sa/.well-known/apple-app-site-association

To clarify, I fully understand that using Developer Mode allows us to bypass the Apple CDN and test Universal Links internally, and in that scenario everything works correctly within our target country environment.

However, the issue arises when the app is distributed via the App Store. In production, Apple CDN servers located outside our target country attempt to fetch the AASA file, and since our firewall is configured to allow access only from within the target country, those external requests are blocked. This results in Universal Links not functioning for end users, even though they are located inside the allowed region.

Our goal is to ensure that Universal Links work for real users in our target country without relaxing our geographic firewall policy for external IPs.

Could you please advise if there are any recommended approaches or best practices for supporting Universal Links in scenarios where regional access restrictions are mandatory?

Thank you for your continued guidance.

Best regards,

Raguraman Asokan

1

Answer 5

DTS Engineer OP

Apple

1w

Thanks for the reply and my apologies I keep not getting notifications on your update.

Our goal is to ensure that Universal Links work for real users in our target country without relaxing our geographic firewall policy for external IPs.

Regrettably, it is not feasible to achieve this. You will need to allow requests from individuals downloading the application from the App Store as well as Apple servers located in various geographic regions for that specific URL.

Albert Pascual   Worldwide Developer Relations.

1