Mcafee agents use a DNS name update.nai.com:80 to connect to Mcafee and download signature updates. The firewall team at my location want a list of ip addresses which they can open on the firewall to allow the connection from agents to Mcafee site. I have noticed that when you ping update.nai.com, the ip address changes after 2-3 minutes.
I thought they used multiple sites and routed via geographical area and loading, all hidden behind that one address. You may be better off just logging a support call for the latest accurate infomation