Apple Intelligence Unavailable in 2026? Split Apple ML & CDN Domains in Clash

What “unavailable” means on the wire

Product messaging frames Apple Intelligence as a unified experience; on the wire it decomposes into several families of requests. Some are ordinary Apple CDN downloads—icons, models, safety filter lists, configuration payloads—often carried on large content networks that mirror other Apple services. Others look like authenticated iCloud or identity flows that must agree with your account region. Still others resemble low-latency inference-style sessions where the OS negotiates TLS to first-party hosts and keeps the session alive while you type or dictate.

Clash does not know which of those packets “are AI.” It sees connection metadata—typically a hostname or an IP after DNS—and walks your rules from top to bottom. If a flow is forced through a congested proxy when Apple expects a short path to a nearby edge, you may see slow feature rollout, endless “preparing,” or hard failures that resemble region restrictions even when the account is eligible. Conversely, if you split routing too aggressively and accidentally DIRECT a hop that only answers from a different egress, the UI may simply refuse to proceed.

Separating policy problems from network problems is the first discipline. Turn Clash off for a controlled test on the same Wi‑Fi, with the same Apple ID, and repeat the action. If the feature remains unavailable, prefer Apple’s support flows and account checks. If it only fails with split routing enabled, the rest of this article applies.

Step 1: Establish a baseline Apple path

Before editing YAML, decide what “healthy” looks like. On macOS and iOS, sign out of beta turbulence if you are comparing against public behavior, confirm date and time are automatic, and disable secondary VPNs that nest tunnels. Then run two experiments: all traffic DIRECT inside Clash (or global mode that still honors domestic exceptions if you need them), and plain system networking with Clash disconnected entirely.

If both baselines succeed, write down which interface and resolver you used. Many failures track back to DNS on the cellular modem or a guest Wi‑Fi that filters DoH. The goal is not ideological “Chinese DNS versus foreign DNS”—it is consistency. Apple’s clients cache aggressively; a resolver that lies or splits horizons can present as feature unavailability long after you “fixed” the proxy.

At this stage, also confirm your subscription itself is not the bottleneck. A stale subscription URL or expired token has nothing to do with Apple Intelligence, yet it wastes debugging time. Refresh your profile from a clean network and verify nodes respond—our subscription auto-update checklist covers HTTPS, User-Agent quirks, and timestamp skew that affect any remote rule list, not only commercial nodes.

Step 2: Capture hostnames like a technician

Guessing DOMAIN-SUFFIX entries from memory is how profiles sprawl. Instead, reproduce the failure once with debug-level routing logs in Clash Meta (mihomo) or your GUI’s equivalent. You want the resolved host string that accompanied each failing TCP or QUIC session, not only the final IP. If your client shows process names, keep them—on macOS, first-party daemons sometimes originate connections that share a bucket rule with Safari unless you split finer.

Export a short window of lines around the failure; redact tokens and device identifiers before sharing publicly. Sort hostnames into three buckets mentally: (1) obvious Apple CDN and installer surfaces—often long swcdn-style names or familiar mzstatic asset paths; (2) account and push infrastructure—think identity and sync rather than “model weights”; (3) anything that clearly needs your preferred outbound because your uplink blocks TLS to that region without transiting your node.

When you cannot see domains because connections arrive as raw IPs, suspect DNS mode and fake-ip interaction. That is not a moral failing of the mode—it is a reminder to read domain and IP matchers together. Our Fake-IP versus Redir-Host guide walks through local domain failures that echo here when Apple frameworks resolve earlier than Clash expected.

Step 3: Design DOMAIN-SUFFIX lanes for Apple

DOMAIN-SUFFIX remains the workhorse matcher for first-party trees. A suffix on apple.com is broad—intentionally so for exploration—but broadness can collide with unrelated subdomains you wanted elsewhere. In practice, maintain two policy groups: APPLE_DIRECT (or reuse DIRECT) for discovery, storefront, and certificate-heavy surfaces; and APPLE_PROXY (or your regional US/SG group) only for suffixes your captures prove need the exit you control.

Illustrative skeleton—treat names as placeholders and replace group labels with yours:

rules:
  - DOMAIN-SUFFIX,mzstatic.com,APPLE_DIRECT
  - DOMAIN-SUFFIX,cdn-apple.com,APPLE_DIRECT
  - DOMAIN-SUFFIX,apple.com,APPLE_DIRECT
  - DOMAIN-SUFFIX,icloud.com,APPLE_DIRECT
  - DOMAIN-SUFFIX,apple-cloudkit.com,APPLE_DIRECT
  - # Add only if logs show they need your outbound:
  - DOMAIN-SUFFIX,example-apple-ml-host.apple.com,APPLE_PROXY
  - # ... your general GEOIP / domestic DIRECT ...
  - MATCH,FINAL

The last decorative line is intentionally generic: your catch-all may be named PROXY or nested differently. What matters is relative order—specific Apple exceptions before wide foreign buckets, and any experimental “AI proxy” suffix only after you have log evidence. Community Rule Providers that bundle Apple CDNs are convenient but opaque; if a list suddenly sends dozens of suffixes to REJECT, symptoms will look like mysterious Apple breakage. Audit changes the way you audit ad lists.

Step 4: Align DNS, TUN, and rule visibility

Split routing fails mysteriously when applications resolve outside the tunnel. On iOS, Clash-style clients live in Network Extension land; on desktop, browsers may use secure DNS while terminal tools use libc. If Safari resolves AAAA records through a path Clash does not own, your meticulously ordered DOMAIN-SUFFIX lines never see the names you wrote them for.

Enable TUN mode (where supported) for a transparent capture that mirrors what we describe for desktop stacks in the Windows and macOS TUN article. Then verify that the client’s DNS section lists resolvers reachable from inside the tunnel—public UDP, DoH, or operator-specific resolvers your node supports. If you must keep system-proxy-only mode, point each toolchain explicitly at the local HTTP or SOCKS port and accept that some Apple daemons will not honor it; that gap shows up exactly as “AI works in one app, not another.”

IPv6 deserves a deliberate toggle. Apple platforms increasingly prefer dual-stack. If your exit node mishandles IPv6 while AAAA answers exist, symptoms look like intermittent unavailable banners rather than clean error codes. Either provide a working v6 path through the tunnel or align your policy so Apple hosts fall back predictably—our IPv6 split checklist lists kernel and resolver checks in order.

Step 5: Disentangle region locks from routing mistakes

Apple Intelligence availability is not only a traceroute puzzle. Language bundle, device class, and account country interact with server decisions. When the service refuses for account reasons, logs often show clean HTTP exchanges terminating with business error payloads rather than middlebox resets. Clash cannot decode those semantics; it only delivers bytes.

Network-side mimicry—changing DNS geo hints or exiting through distant nodes—sometimes changes which CDN edge answers first. That can help when the real issue was a poisoned resolver or a censored path; it does not override Apple ID policy. Avoid treating proxy selection as entitlement. Document what you tested: same account, same device class, differing only in DIRECT versus APPLE_PROXY, with timestamps, so you do not chase ghosts.

If governmental or corporate filtering blacklists specific Apple infrastructure outright, your honest options are policy compliance or alternate connectivity that is legal where you use it. Clash improves transparency; it does not grant exemptions.

What people actually see in the field

Three repeating stories show up in community threads. First: the user routes “everything foreign” through a default node and notices only Apple Intelligence degrades. The fix lane is separating Apple CDN legs that need short RTT from generic proxy hairpins. Second: aggressive ad block or “privacy” lists intercept Apple metrics domains; model downloads stall at zero percent until the list is relaxed. Third: laptop users combine corporate SSL inspection with a personal VPN—Apple features break on certificate mismatch before routing ever matters.

Use a small matrix while you iterate, not a debate club manifesto:

Each row is a triage hint, not a verdict. Let your own logs upgrade or downgrade confidence.

How this connects to general YAML discipline

Nothing here replaces fundamentals: policy group naming, nested selectors, RULE-SET precedence, and merge ordering still dominate outcomes. When two maintainers hand you partial profiles, split routing bugs often come from silent duplication—wrong MATCH height or a duplicated provider that reintroduces a broad GEOIP before your Apple exceptions.

For structured theory and ordering examples, keep the YAML routing guide nearby. When things still feel irrational after your Apple suffix lanes look sane, escalate to log reading: our matched rule and FINAL tutorial explains why lines you swear should hit instead feed the catch-all.

Short answers worth repeating

Does Apple publish a fixed list of “Intelligence domains” for firewall admins? Public documentation emphasizes capability and privacy architecture, not a static manifest you should paste into production ACLs. Operational lists age quickly; your resolver logs stay current.

Should Private Relay interact with this? iCloud Private Relay changes egress selection for Safari-like traffic. Combined with TUN, you may see double encapsulation or unexpected DNS chains. Test with Relay temporarily disabled when symptoms are exotic.

What about beta seed configurations? Seed profiles sometimes flip feature flags and endpoints. Keep a note of build numbers when you compare captures; a hostname that appeared in beta may vanish in GM.

Open sources and where to download clients

Clash cores and forks move quickly; behavior details shift between releases. The mihomo repository remains the authoritative place for engine issues and advanced examples. Treat GitHub as the engineering hub, not the primary installer channel—use vendor builds or this site when you want a stable package path.

Closing thoughts

Apple Intelligence in 2026 sits at the intersection of machine learning backend engineering and ordinary CDN mechanics. Users feel it as one toggle; your Clash profile should respect the underlying heterogeneity. Build Apple CDN and identity paths you can explain, add narrow DOMAIN-SUFFIX proxy lanes only with logs in hand, and pair those choices with DNS and TUN settings that let rules see the names you wrote.

Compared with opaque one-knob VPNs, transparent split routing trades a steeper learning curve for outcomes you can reproduce. That reproducibility matters when a seasonal OS update shifts a hostname and your afternoon suddenly fills with “AI unavailable” reports—good notes beat panic reinstalls.

Browse the full tech column for more split routing patterns; when mobile import still fights you, return to the iOS 18 checklist for tunnel-side fixes.