This page lists services to allow in an enterprise environment.

The following are domains used for Private Relay in which traffic gets tunneled to Apple and then to Cloudflare before egressing to the Web.

• mask.icloud.com
• mask-h2.icloud.com