iCloud Private Relay IP Ranges
iCloud Private Relay sends Safari traffic through two hops, and the address a website sees is the second hop's. Apple publishes every address that second hop can use as a CSV file, with a country, region and city against each one, so that sites and geolocation services can recognise relay traffic and still place it roughly right. On 16 October 2026 the file held 285,090 rows: 41,734 IPv4 prefixes, covering 105,647 addresses, and 243,357 IPv6 prefixes.
Known IP ranges
Apple does not route Private Relay's exit addresses itself. These are the prefixes in Apple's egress list, mask-api.icloud.com/egress-ip-ranges.csv, as fetched on 2026-10-16: 41,734 IPv4 prefixes and 243,357 IPv6 prefixes. They belong to the partners that run Private Relay's second hop - in a sample of 300 IPv4 prefixes, 147 were announced by Cloudflare, 99 by Akamai and 54 by Fastly. WHOIS names the partner; the list is what says it is Private Relay.
172.225.75.0/24
172.225.76.0/24
172.225.90.0/24
172.225.113.0/24
172.225.237.0/24
172.226.30.0/24
172.226.222.0/24
172.225.5.0/25
172.225.30.0/25
172.225.116.0/25
2a04:4e41:700::/40
2a04:4e41:b00::/40
2a04:4e41:f00::/40 (IPv6)
What does an iCloud Private Relay IP mean in a privacy test?
A Private Relay address as your visible IP means the relay is working: the site sees an exit run by Cloudflare, Akamai or Fastly, placed in your region, instead of your own address. If a test shows your real IP while Private Relay is on, the request did not go through the relay - other browsers, most app traffic and some network settings bypass it.
A list with a location on every line
Each line of egress-ip-ranges.csv is a prefix followed by a country code, a region code and a city - the geofeed format of RFC 8805. That is the point of the file: Private Relay keeps a user's approximate location, so a site can still show local content, and the CSV tells geolocation databases which exit stands for which place. The file covers 235 country codes. The United States alone takes 181,005 rows across 4,734 city names; Germany, Brazil and Japan follow far behind.
The prefixes are small. Of the IPv4 entries, 20,409 are single /32 addresses and 19,419 are /31 pairs; the widest are seven /24s. That granularity is what lets one city's exits be told apart from the next city's.
Who actually runs the exits
Apple runs the first hop, which sees who you are but not where you are going. The second hop - the one that fetches the page and whose address the site sees - is run by partners. A sample of 300 IPv4 prefixes from the list, checked on 16 October 2026, came back 147 Cloudflare (AS13335), 79 Akamai on AS36183 and 20 on AS20940, and 54 Fastly (AS54113). None was announced by Apple's own AS714.
For a site owner, the list is the reliable way to recognise relay traffic: many visitors will share one exit, so rate limits and fraud scores built for a single household misfire on it. To see what a site sees from your own connection, run the iCloud Private Relay leak test.
Related tools
Frequently asked questions
What IP ranges does iCloud Private Relay use?
The prefixes in mask-api.icloud.com/egress-ip-ranges.csv: 41,734 IPv4 and 243,357 IPv6 on 16 October 2026, each tagged with a country, region and city. They are run by Cloudflare, Akamai and Fastly.
Why does an iCloud Private Relay IP appear in my privacy test?
A Private Relay address as your visible IP means the relay is working: the site sees an exit run by Cloudflare, Akamai or Fastly, placed in your region, instead of your own address. If a test shows your real IP while Private Relay is on, the request did not go through the relay - other browsers, most app traffic and some network settings bypass it.
Why does WHOIS say Cloudflare or Akamai for my Private Relay IP?
Because those companies run Private Relay's second hop, the one websites see. In a sample of 300 IPv4 prefixes from Apple's list, 147 were Cloudflare's, 99 Akamai's and 54 Fastly's; none was Apple's own network.
Does iCloud Private Relay hide my location?
It hides your exact address, not your region. Each exit in Apple's list is tagged with a country, region and city, and by default the relay picks one near you so sites can still show local content.
How can a website detect iCloud Private Relay?
By matching the visitor's address against Apple's published egress list. Apple publishes it precisely so that sites and geolocation services can recognise relay traffic.