IdentityLookup deferQueryRequestToNetwork error 3 despite valid AASA and extension setup

I'm seeking help troubleshooting a persistent com.apple.IdentityLookup.error.messagefilter Code=3 error when my Message Filter Extension tries to defer to network. I’ve exhausted Apple documentation and forum posts, and Apple Support has asked me to escalate this via the forums to reach engineering.

✅ My Setup: Xcode: 16.2

macOS: Sequoia 15.3.1 (Apple Silicon Mac mini)

Device: iPhone 14 Pro

iOS: 18.3.2 (Developer Mode enabled)

Tested via: TestFlight install on real device

📦 App Structure: Main App Target (minimal "hello world" logic)

Message Filter Extension Target

Messages Extension Target

Message Reporting Extension Target

Notifications Extension Target

✅ Capabilities & Configurations Main App Capabilities: App Groups: group.com.example.shared

Network Extensions: Content Filter

Associated Domains:

messagefilter:my-api.example.com  
applinks:my-api.example.com

Message Filter Capabilities:

App Groups: same as main app

Network Extensions: Content Filter

Associated Domains: same as above

📄 Info.plist Config

Main App Info.plist:

NSAppTransportSecurity with:

NSAllowsArbitraryLoads = YES

Exception domain my-api.example.com with:

NSIncludesSubdomains = YES  
NSTemporaryExceptionAllowsInsecureHTTPLoads = YES  
NSTemporaryExceptionMinimumTLSVersion = TLSv1.2

MessageFilter Info.plist:

Same ATS settings as above

NSExtension block:

<key>NSExtension</key>
<dict>
  <key>NSExtensionAttributes</key>
  <dict>
    <key>ILMessageFilterExtensionNetworkURL</key>
    <string>https://my-api.example.com/api/sms-filter</string>
    <key>ILClassificationExtensionSMSReportDestination</key>
    <string>+10000000000</string>
  </dict>
  <key>NSExtensionPointIdentifier</key>
  <string>com.apple.identitylookup.message-filter</string>
  <key>NSExtensionPrincipalClass</key>
<string>$(PRODUCT_MODULE_NAME).MessageFilterExtension</string>
</dict>

📜 Entitlements

Main App Entitlements

<key>com.apple.developer.associated-domains</key>
<array>
  <string>messagefilter:my-api.example.com</string>
  <string>applinks:my-api.example.com</string>
</array>
<key>com.apple.developer.networking.networkextension</key>
<array>
  <string>content-filter-provider</string>
</array>
<key>com.apple.security.application-groups</key>
<array>
  <string>group.com.example.shared</string>
</array>

Message Filter Extension Entitlements

Identical to main app’s, scoped to the extension.

📄 AASA File (Hosted on https://my-api.example.com/.well-known/apple-app-site-association)

Serves as application/json, returns 200 OK, and is reachable on device via Safari. Logs confirm AASA is downloaded and installed successfully during TestFlight install.

{
  "applinks": {
    "apps": [],
    "details": [
      {
        "appID": "TEAMID.com.example.app",
        "paths": ["*"]
      },
      {
        "appID": "TEAMID.com.example.app.MessageFilter",
        "paths": ["*"]
      }
    ]
  },
  "messagefilter": {
    "apps": [],
    "details": [
      {
        "appID": "TEAMID.com.example.app",
        "filterType": "URL",
        "domains": ["my-api.example.com"]
      },
      {
        "appID": "TEAMID.com.example.app.MessageFilter",
        "filterType": "URL",
        "domains": ["my-api.example.com"]
      }
    ]
  },
  "classificationreport": {
    "apps": [],
    "details": [
      {
        "appID": "TEAMID.com.example.app",
        "domains": ["my-api.example.com"]
      },
      {
        "appID": "TEAMID.com.example.MessageReporting",
        "domains": ["my-api.example.com"]
      }
    ]
  }
}

❌ The Problem

When the extension launches and receives an SMS to classify, logs show:

deferQueryRequestToNetwork failed: The operation couldn’t be completed. (com.apple.IdentityLookup.error.messagefilter error 3.)

The extension loads, network URL is available, the AASA is installed, and yet the extension is not allowed to defer to network. This occurs every time.

🧪 Other Notes

Tried rebuilding everything from scratch

Archiving to TestFlight, not running via Xcode

Clean entitlements verified using codesign -d --entitlements :-

Console logs show no issues with AASA download or validation

Any help or insights from Apple engineering or others in the community who have successfully deployed a working Message Filter Extension would be hugely appreciated.

Thanks in advance 🙏