Connection details

The info icon at the top of the alert (⌘I) opens the technical evidence: where the program lives, who signed it, and the raw endpoint. Its accessibility name is Show details, and its help is “Show the program’s path, signature and the connection’s address (⌘I)”. The same control hides them (“Hide details”). There is no button whose title is Details.

The details area

The grid sits under About this connection and above Your answer. Its rows:

• Program: the executable’s full path, or “Unknown”. A helper shows its own path inside the bundle.
• Identifier: the signing identifier Outbound trusts, or the claimed identifier followed by “ (not verified)“, or “None”.
• Signed by: the organisation and team, as “(organisation) · team (ID)”, or “Developer ID · team (ID)” when no organisation is known, or “Apple”, or “Not verified”.
• Signature check: why the filter’s signature check failed, only when it reported a reason.
• Process ID: the PID, only when the system reported one.
• Address: the raw IP address, or “Not resolved yet”.
• Name source: where the server’s name came from, and whether it is verified (see below).
• Location: flag, city, region, and country, only when the location database knows the address.
• Port, or Local port for an incoming connection: the port and the protocol, joined when both exist (“443 · TCP”).
• Direction: Incoming or Outgoing.

At the bottom, How to Read an Alert… opens a lesson in the main window that walks through each part of the alert. Help › How to Read an Alert… opens the same lesson.

Values are monospaced and can be selected. Show in Finder, at the top right, reveals the app bundle that contains the program, or the path itself when there is no bundle.

VoiceOver’s summary of the whole alert is the program, then “wants to connect to” or “is receiving a connection from”, the server, and “on port” or “on local port” with the protocol in parentheses when both are known. A program’s own DNS lookup says it wants to look up the name through that DNS server.

The same button hides the grid. To have it open as soon as the alert appears, set Settings › Alerts › Alert Window › Details to Full. Compact, the default, leaves it closed until you ask. See Alerts settings.

Whether the server’s name is verified

An app can name any server when it connects, so Outbound says how much it knows about the name:

• Corroborated by a DNS answer: a DNS answer for this name returned the connection’s address. This does not verify the server’s identity.
• Unverified name: the name came from the app’s request, the connection endpoint or TLS, and no DNS answer backs it.
• Known ECH public name: a shared name used by servers with Encrypted Client Hello. It does not reveal the private destination name.
• Address only: the connection has no name of its own.

When Only match host and domain rules on verified names is on in Settings › Security, an unverified name adds “Host and domain allow rules do not apply to this unverified name. Block and ask rules still apply.” The setting is on for new installs and stays off after an upgrade until you turn it on.

When other names recently resolved to the same address, DNS name candidates lists them, with the rule that would decide each one. “Several names can share an address. Candidate rules are evaluated separately and never select a name for this connection.” “Rules disagree” marks a name whose rules decide differently. Show Deciding Rule… or Search Rules… opens the Rules window on it.

The app’s menu

The app’s name in the header is a menu:

• Show Rules and Show in Network Monitor open the main window on that app.
• Show in Finder reveals the app, and Activate (App) brings it forward.
• Copy Name, Copy Signing ID and Copy Path.
• Quit (App)… and Force Quit…, each after a confirmation. Quit lets the app ask you to save your work. Force Quit warns: “Unsaved work may be lost. This does not answer the connection or create a rule.” Outbound checks the process is still the one that asked before it acts.

Beside the app, the alert shows how long ago the connection was attempted, from “just now” to minutes ago. Hold the pointer over it for the exact date and time.

What blocking would break

The info button beside Block (“What blocking this connection is likely to break”) opens a short explanation built from what Outbound knows: a name lookup, Apple software reaching Apple, a tracker from the catalogue, possible telemetry, the app’s own server, a known service, a connection to this Mac, or “Outbound can’t tell what this connection is for”. It adds what the developer documented, when there is something, and ends: “If something stops working, select the connection in the Network Monitor and allow it again.”

Explaining the connection

Explain this connection asks Apple Intelligence on this Mac, or the provider you chose in Settings › Intelligence, for a short plain-language explanation. An on-device explanation is marked “Written on this Mac. It can be wrong.” For a provider off this Mac, the alert first shows What will be sent and asks “Send this request to (provider)?”: only those facts are sent, the explanation can be wrong, and it does not answer the connection. Nothing leaves until you choose Send.

When the app has changed

When the code on disk no longer matches the copy a rule was approved for, About this connection says “(App) changed since you last decided” and What changed compares the copy you approved with the one running now: Signed by, Identifier, Code and, when it moved, Location. Update Rule to This Version… asks you to confirm, then makes the rule apply to the code running now. Nothing else about the rule changes, and Undo puts it back. See Code identity.

The signature line in the header

Above the destination, one line sums up the signature. This is the short form. The Signed by row in the grid is the longer one.

• Apple system software: signed by Apple.
• Signed by (organisation): a Developer ID certificate that has an organisation name.
• From the Mac App Store: an App Store signature.
• Signed by developer team (ID): a team ID whose organisation is not known locally.
• Signature not verified: a signing identifier with no team and no verified Apple signature. Anyone can claim an identifier.
• Not signed: no signature at all.

When the program is not Apple’s and has no team ID, About this connection leads with “macOS can’t confirm who made this program”. Its detail says an unsigned program could be impersonated, which is ordinary for tools you built yourself, and that a name with no developer certificate proves nothing. See Code identity.

What the destination card adds

The details grid is the raw endpoint. The card above it is the readable one. Chips name HTTPS, HTTP, DNS, DNS over TLS, SSH, IMAP, SMTP, NTP, and Apple Push for the ports listed in The connection alert. A sentence beside them, when the port is a known kind, says what the connection is for: encrypted web traffic (and QUIC when port 443 is UDP), unencrypted web traffic, a name lookup, DNS over TLS, SSH, IMAP, SMTP, network time, Apple’s push service, or STUN for a call. An incoming connection says another device is connecting to this Mac, naming the local port when there is one.

About this connection

About this connection sits between the destination and your answer. The title is the situation. The lines under it are the facts, and they are easy to mix up with the title:

• “(App) says: “(purpose)”“, the developer’s own words from an Internet Access Policy.
• “First connection to (domain)”, unless the title already said this is the first use.
• “Tried N times before, last …, blocked every time by a rule or an earlier answer.”
• “Connected here once before” or “Connected here N times before”, and “Blocked one other attempt” or “Blocked N other attempts” when some tries were blocked and some were not.
• “A new server under (domain)”.
• “Already connects to N other (domain) server” or “servers”.
• “(title) is run by (owner)”, when the catalogue names an owner distinct from the company title.

Example data.

While history loads, the card says “Reading (App)’s connection history…”.

Under Your answer, the preview is one line per button. The stock example in the app is “Can connect to files.slack.com, from now on.” Block is “Can’t connect to” the same reach. “on any port” is added only when Port is Any port, and “on any port or protocol” only for that wider choice. When blocking would break something the developer documented, the Block line continues “The developer says:” and quotes them.