MacOS – identityservicesd IP resolving to non-apple IP – possible man-in-the-middle

dnsmacosNetwork

When I dig init-p01md.apple.com using Google DNS 8.8.8.8 returns A name of 219.88.192.83 (SPARK NEW ZEALAND TRADING LIMITED)

Then digging init-p01md.apple.com using Kloth.net (again with 8.8.8.8) returns A name of 2.20.189.156 — an Akaimai address that Apple uses as a cloud provider.

Kloth.net dig of init-p01md.apple.com on 8.8.8.8#53

 >> Non-authoritative answer:
     init-p01md.apple.com   canonical name = init-p01md-lb.push-apple.com.akadns.net.
 >> init-p01md-lb.push-apple.com.akadns.net canonical name = init-p01md.apple.com.edgesuite.net.
    >> init-p01md.apple.com.edgesuite.net   canonical name = a1051.b.akamai.net.
     Name:  a1051.b.akamai.net
     Address: 2.20.189.123
     Name:  a1051.b.akamai.net
     Address: 2.20.189.156

Screenshot from Little Snitch -- identityservicesd connects to init-p01md.apple.com that resolves to 219.88.192.83 -- a non apple address

Any ideas why it would be resolving to a local NZ IP address?

Best Answer

This is intended behavior.

Content Delivery Networks such as Akamai work by getting the data closer to the user so that downloads and other interactions perform better.

The way this is done is to have multiple servers located all over the globe. You will in general then be using a server that is near you - i.e. if you're in France, you could be using a German server while if you're in New York you might be communicating with a server in Washington D.C.

There are multiple ways of achieving such a system up. A simple one, which is the one you're have come across here, is to use the DNS (domain name system). The DNS system is responsible for (amongst other things) to resolve a name (such as init-p01md.apple.com) into an IP (such as 219.88.192.83). Akamai simply makes their DNS server reply with different IP addresses according to who asks it. That way they can redirect traffic intended for the same service to various servers across the globe.

Related Question