apple.txt missing `+.push.apple.com` — some Apple subdomains go proxy and trigger account risk

[tr4v3ler]

With RULE-SET,apple,DIRECT, some Apple subdomains are not in apple.txt and fall through to proxy (e.g. RULE-SET,proxy or MATCH). Others like ocsp2.apple.com are in apple.txt and go direct. Same account ends up with mixed direct/proxy traffic and different IPs, which can trigger Apple’s risk controls.

Examples:

Domain	In apple.txt	Routing
ocsp2.apple.com	Yes	Direct
11-courier.push.apple.com	No	Proxy
gsa.apple.com	No	Proxy

Suggestion: Add +.push.apple.com to apple.txt so all *.push.apple.com (e.g. 11-courier) are covered. Optionally add +.apple.com as a catch-all for other subdomains like gsa.apple.com.

[clashhub-net]

这个问题确实存在。建议在 apple.txt 中添加：

+.push.apple.com
+.apple.com\

这样可以覆盖所有 Apple 推送通知和子域名，确保一致走 DIRECT 路线。

另外检查一下是否有其他常见 Apple 域名遗漏，比如：

• gsa.apple.com
• ls.apple.com
• coverage.push.apple.com

希望这个建议有帮助！

[clashhub-net]

You can manually add the missing Apple push domains to your local rules:

- DOMAIN-SUFFIX,push.apple.com,DIRECT
- DOMAIN-SUFFIX,courier.push.apple.com,DIRECT
- DOMAIN,api.push.apple.com,DIRECT

Or use DOMAIN-SUFFIX,apple.com,DIRECT to cover all Apple domains.