I use iCloud only for testing the iCloud sync feature of my App Store apps. As I mentioned in my recent blog post Apple account email address disclosure via Mail app, I don’t have an iCloud email account. As you can see in my screenshots below, iCloud is disabled in System Settings for all uses of Mail.
Nonetheless, when I send an email in Mail app, from a non-iCloud account to an non-iCloud account, Mail immediately triggers an iCloud connection, as revealed by Little Snitch. In testing, I’ve reproduced this behavior repeatedly.
The cloudd process attempts to connect to the URL https://gateway.icloud.com:443/ckdatabase/api/client/query/retrieve, and the nsurlsessiond process attempts to connect to the URL https://gateway.icloud.com:443/ckdatabase/api/client/record/save, over both TCP and UDP, likely falling back to the alternate protocol when I block the first connection attempt.
Unfortunately, I haven’t been able to analyze the connection details with Proxyman, because iCloud uses certificate pinning, so Proxyman can’t decrypt the packets. In my testing, a network extension doesn’t get access to unencrypted data either. Thus, I don’t know the answer to the question posed by the title of this blog post: Why does Mail app contact iCloud when sending a non-iCloud email?
What could Mail be querying and saving in CloudKit when I’ve disabled Mail in iCloud? Why does Apple need to know when I’m sending emails?
I’ve decided to create Little Snitch rules to block cloudd and nsurlsessiond from connecting to gateway.icloud.com, and I’ll temporarily disable the rules if and when I need to test iCloud sync for software development purposes.
It appears that the method that I used years ago for Logging https requests and responses of Apple system processes no longer works.
sudo launchctl setenv CFNETWORK_DIAGNOSTICS 3However, I noticed an intriguing comment on Hacker News:
It's previous recipients synced over iCloud.
Run this and then send an email to see it: log stream --predicate 'subsystem == "com.apple.cloudkit"' --info --debug
The comment is actually marked [dead] for some reason, so you have to be logged in to Hacker News with the showdead setting enabled in order to read it.
According to an Apple support document:
When you are signed in to the same Apple Account on all of your devices, and when Contacts is turned on in iCloud settings, your Previous Recipients list is available on your other macOS, iOS, and iPadOS devices.
As you can see in my screenshot at the beginning of this blog post, I have Contacts turned off in iCloud settings, so my Previous Recipients list should not be synced to iCloud. Nonetheless, I followed the commenter’s suggestion of logging in Terminal. I saw log messages that referred to com.apple.mail.recents, which might indicate Previous Recipients and would certainly explain why this happens when I send an email.
cloudd: (CloudKitDaemon) [com.apple.cloudkit:PCS] Failed to fetch PCS data from the server for record <CKRecordID: 0x8cee21d00; recordName=KeyValue:4FF44666-A6BB-495C-B7A5-62E9D7EE605C, zoneID=com.apple.mail.recents:__defaultOwner__>: Error Domain=NSURLErrorDomain Code=-1001
cloudd: (CloudKitDaemon) [com.apple.cloudkit:CK] Sending record save completion to client for operation C5E510EE4D450B57 for recordID: <CKRecordID: 0x8cee21d00; recordName=KeyValue:4FF44666-A6BB-495C-B7A5-62E9D7EE605C, zoneID=com.apple.mail.recents:__defaultOwner__>
I also saw log messages that included containerID=com.apple.icloud-bcassets-brandedemail, qos=UserInitiated, operationID=400B597EBB882D02, applicationBundleIdentifierOverrideForNetworkAttribution=com.apple.businessservicesd, but unlike the com.apple.mail.recents messages, the com.apple.icloud-bcassets-brandedemail messages didn’t appear to involve any connection error, even though I was blocking gateway.icloud.com for Mail.
My tentative theory, then, is that perhaps Mail app is attempting to sync my Previous Recipients to iCloud, despite the fact that Contacts and Mail are disabled in iCloud System Settings?
I think the tentative theory is correct. Using Find Any File, I found the file com.apple.mail.recents as well as com.apple.calendar.recents, com.apple.eventkit.locations, com.apple.facetime.recents, and com.apple.passbook.locations in this folder:
~/Library/
These are NSKeyedArchiver plist files. The good news is that the files do not appear to contain any personal data.
The folder below contains an SQLite database that does list all of my Mail app previous recipient email addresses:
~/Library/
I think, though, I hope, that they are not synced to iCloud, if the SyncedPreferences files are indicative. I’m not sure why there is any syncing of the recents files when I’ve disabled all of the relevant features in iCloud settings.
I do object to notifying Apple that I’ve just sent an email. That in itself seems like a violation of my privacy.