August 3 2026

I use iCloud only for testing the iCloud sync feature of my App Store apps. As I mentioned in my recent blog post Apple account email address disclosure via Mail app, I don’t have an iCloud email account. As you can see in my screenshots below, iCloud is disabled in System Settings for all uses of Mail.

Nonetheless, when I send an email in Mail app, from a non-iCloud account to an non-iCloud account, Mail immediately triggers an iCloud connection, as revealed by Little Snitch. In testing, I’ve reproduced this behavior repeatedly.

The cloudd process attempts to connect to the URL https://gateway.icloud.com:443/ckdatabase/api/client/query/retrieve, and the nsurlsessiond process attempts to connect to the URL https://gateway.icloud.com:443/ckdatabase/api/client/record/save, over both TCP and UDP, likely falling back to the alternate protocol when I block the first connection attempt.

Unfortunately, I haven’t been able to analyze the connection details with Proxyman, because iCloud uses certificate pinning, so Proxyman can’t decrypt the packets. In my testing, a network extension doesn’t get access to unencrypted data either. Thus, I don’t know the answer to the question posed by the title of this blog post: Why does Mail app contact iCloud when sending a non-iCloud email?

What could Mail be querying and saving in CloudKit when I’ve disabled Mail in iCloud? Why does Apple need to know when I’m sending emails?

I’ve decided to create Little Snitch rules to block cloudd and nsurlsessiond from connecting to gateway.icloud.com, and I’ll temporarily disable the rules if and when I need to test iCloud sync for software development purposes.