Hi Everyone,
We're experiencing a persistent issue where Apple's CDN returns SWCERR00301 Timeout for some of our associated domains, while other domains hosted on the exact same server work perfectly.
Note: Using aliases below for privacy. "working.example.com" and "failing.example.com" are not our actual domains.
The Problem
Our app has multiple associated domains. When checking Apple's CDN:
Working domain:
$ curl -sD - "https://app-site-association.cdn-apple.com/a/v1/www.working.example.com" -o /dev/null
HTTP/1.1 200 OK
Apple-Origin-Format: json
Cache-Control: max-age=21600,public
Failing domain (same server, same IP, same AASA content):
$ curl -sD - "https://app-site-association.cdn-apple.com/a/v1/www.failing.example.com" -o /dev/null
HTTP/1.1 404 Not Found
Apple-Failure-Reason: SWCERR00301 Timeout
Apple-Failure-Details: {"cause":"context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
Apple-Try-Direct: true
Cache-Control: max-age=3600,public
On device, swcutil dl -d www.failing.example.com returns SWCErrorDomain error 7, confirming the CDN has no valid cache.
What We've Verified
Both domains are hosted on the same server (same IP) and serve identical AASA files:
HTTP 200, Content-Type: application/json, 229 bytes
Valid JSON with correct appID
Valid SSL certificates (Amazon RSA 2048), no redirects
Both registered in the app's Associated Domains entitlement
Response time < 500ms from multiple locations
We simulated Apple's crawler locally:
$ curl -H "User-Agent: com.apple.swcd (unknown version) CFNetwork/1568.200.51 Darwin/24.1.0"
--connect-timeout 5 --max-time 5 -4 --tls-max 1.2
"https://www.failing.example.com/.well-known/apple-app-site-association"
Result: 200 OK, 0.25s — well within the 5-second limit. We cannot reproduce the timeout from any network we've tested.
Scope
Out of 43 associated domains, 5 return 404 (Timeout) on Apple CDN while the other 38 work fine. All 43 domains serve valid AASA files from the same server infrastructure.
What We've Tried
Verified AASA content, headers, SSL, and response times for all domains
Submitted new TestFlight builds to trigger re-crawl — timeout persists
The failing CDN cache (max-age=3600) expires every hour, but Apple's crawler keeps timing out on retry
No WAF or rate-limiting rules that would block Apple IPs (17.0.0.0/8)
Impact
The failing domain is our primary email campaign domain. Universal Links not working means newsletter links open in the browser instead of the app, affecting millions of email recipients daily.
Questions
Is there a way to request Apple's CDN to refresh/invalidate the cache for specific domains?
Could the Apple crawler be experiencing connectivity issues to our server (AWS us-west-2) for specific SNI hostnames?
We have 43 associated domains — could the volume affect crawl reliability?
Is there an internal team we can escalate this to for CDN-side investigation?
Any guidance would be greatly appreciated. Thank you!
4
1
181