Carrier.plist

carrier.plist is the main settings file of a carrier bundle. The Apple Wiki page documents it as of iOS 3 and 4. This page covers the current bundles: the newest copy of each of the 781 carrier bundles this site holds. Numbers in tables marked live are read from those bundles when the page is loaded; the rest were counted in October 2026, when the bundles used 318 different top-level keys.

Per-phone overrides_*.plist files and MVNO configurations use the same keys; see Bundle Selection.

Common keys

The most used top-level keys, with the number of bundles that set them:

PhoneNumberRegistrationGatewayAddress is +447786205094 in 251 bundles. The Apple Wiki gives 28818773 for the US and Canada; only 12 bundles still use it.

IMSConfig

IMSConfig is the biggest dictionary in most modern bundles. Its sections, by number of bundles: Voice (464), Signaling (443), Media (429), XCAP (417), ConferenceCalling (367), SMS (366). Signaling.SipTimers overrides the SIP timers from RFC 3261, in milliseconds.

IMSConfig.ConferenceCalling.conferenceServer is usually the 3GPP default, sip:mmtel@conf-factory.ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org. Some bundles leave the template unfilled: Hutchison_Wind_it has mnc${MNC}.mcc${MCC}, CW_wi mnc${mnc}.mcc${mcc} with a trailing space, and Telia_se leaves out the sip:.

APNs

Each entry in apns has an apn, username, password and a type-mask saying what the APN is for. The type-mask table on the Apple Wiki was already marked out of date for iOS 4. The bits below are inferred from the names of the 1,656 APNs in the current bundles, by looking at which APN names carry each bit and which bits appear on their own:

0x30 (48) for tethering is the same as in iOS 3. Bits 3, 6, 9 and 12 each appear on two to four APNs. ???

Newer entries also have tech-type-mask, AllowedProtocolMask, AllowedProtocolMaskInRoaming, AlwaysOnPDU, UseNetworkMTU and NoCellularReconnectCauseCodes.

Many APN passwords are not secret and are the same for every customer: beeline (VimpelCom_ru), mts (MTS_by), t-mobile (TMobile_mk), wap (Talkmobile_uk, Digicel_tt), data (Safaricom_ke).

MMS proxies

The MMS.Proxy of most carriers outside the US is an address inside the carrier’s own network. A few are memorable:

MTS_by              192.168.192.168:8080
Ice_no              10.10.10.10:80
Swisscom_Wingo_ch   192.168.210.002:8080      (leading zeros)
MTN_cy              172.24.97.1:3130

Oddities

Things in the current bundles that look like mistakes, leftovers or one-offs.

Typos and placeholders

• The enhanced 911 block in StrataNetwork_LTE_US is spelled Lcoation:

Lcoation.EmergencyLocation.AugmentedEmergencyAction.Supplemented911.HTTPS.URL   meridian.cdn-apple.com/location

Spelled Location, the same setting is in 63 other bundles (live). Unless something reads the misspelling, this one does nothing.

• There is a key named Key New with the value Value in Vodafone_Travel.
• Sprint_ISIM_LTE_US and Sprint_Boost_ISIM_LTE_US have ResetSIMProvisoning.
• USCellular_LTE_US has a cell broadcast alert type named Test, and ATT_FirstNet_US lists Test in EmergencyCalling.IgnoreEENLSubServiceFields.
• CarrierLab points XCAP at bsf.test.3gpp.com; Vodafone_qa uses the push topic qa.com.vodafone.watch.test.entitlement.

Extreme values

The bundle with the largest value of a numeric setting, against the median of every bundle that sets it (live):

2147483647 is the largest signed 32-bit integer.

Only one bundle disagrees

Settings that 40 or more bundles set, where exactly one bundle has the other value:

• Afghanistan’s Etisalat_af is the only one of 73 bundles where CellBroadcast.AlertTypes.Presidential.UserConfigurable is true: Afghan users can turn off presidential alerts. It also has its own alert names, Extreme Threats, Severe threats (lower case) and AMBER alerts.
• EMT_ee is the only one of 139 with SupportsOnDevicePhysicalSIMConvert false.
• Vodafone_tr is the only one of 148 with SupportPhysicalSIMtoESIMTransfer false.
• Mobifone_vn is the only one of 246 with TechSettings.IKE.NATTKeepAliveOffload false.
• StrataNetwork_LTE_US is the only one of 321 with IMSConfig.Signaling.RequirePreconditionsWhenMandatory true.
• Inland_LTE_US is the only one of 166 with EnableLTEAfterUpgrade false.
• Default is the only one of 259 with ShowWiFiCallingWarningUnsupportedCarrier true.

Keys only one bundle has

PreventWiFiHandoverInEmergency is set only by Verizon_LTE_US and Verizon_MVNO_US. AllowFaceTimeOverCellular only by CMCC_cn and CBN_cn. IllinoisValley_US and SilverStar_US prefix international SMS with +011. KDDI’s two _NR_ bundles are the only ones with satellite settings (SupportsSatellite, SatelliteApps, SatelliteAccessInfo).

StockSymboli, the Stocks app key from iOS 1, is still in a dozen bundles (Telus_ca, Rogers_ca, Telia_se, Telenor_no, …). Sprint_CSIM_LTE_US uses it to add TMUS to Stocks.

See also

• Carrier Bundle
• Bundle Selection
• Carrier.plist on The Apple Wiki