TECH Signal 304 2 feeds carried it
Why does Mail app contact iCloud when sending a non-iCloud email?
↗
Illustration only Photo by Maarten Deckers on Unsplash
The Mail app contacts iCloud via CloudKit when sending any email, apparently to sync the previous recipients list even when iCloud Mail and Contacts are disabled.
This behavior generates unexpected network traffic and raises privacy concerns for users who have turned off iCloud sync for Mail. Understanding that disabling iCloud in System Settings does not stop CloudKit activity helps engineers decide whether to block the connections with firewall rules or accept the overhead.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The app initiates connections to gateway.icloud.com using the cloudd and nsurlsessiond processes for each sent email.
Log entries show activity tied to com.apple.mail.recents, indicating a sync attempt of the previous recipients list via CloudKit.
Blocking those iCloud connections results in CloudKit error messages but does not prevent the email from being sent.
THE READ
What the cluster adds up to.
When sending an email from a non-iCloud account, the Mail app triggers outbound connections to the iCloud gateway. Little Snitch shows the cloudd process attempting to reach https://gateway.icloud.com:443/ckdatabase/api/client/query/retrieve and the nsurlsessiond process trying https://gateway.icloud.com:443/ckdatabase/api/client/record/save. These connections occur over both TCP and UDP, with a fallback to the alternate protocol if the first is blocked.
Enabling a log stream for the CloudKit subsystem reveals messages that reference com.apple.mail.recents, which is associated with the previous recipients list. The author also found local files named com.apple.mail.recents and related containers in ~/Library/Containers/com.apple.corerecents.recentsd/, confirming that Mail stores this data locally even though iCloud Contacts and Mail are turned off in System Settings.
Blocking the iCloud endpoints with Little Snitch produces error logs such as "Failed to fetch PCS data from the server" and "Sending record save completion to client", yet the email transmission continues successfully. This indicates that the CloudKit sync attempt is not required for the core sending function, but it does generate background traffic and potential error conditions when the network path is unavailable.
Because iCloud uses certificate pinning, tools like Proxyman cannot decrypt the payload, so the exact content of the CloudKit queries and saves remains unknown. The author’s hypothesis that Mail is trying to sync the previous recipients list is based on log identifiers and file locations, and therefore remains tentative pending further inspection.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER