Not Blocking Apple Relay

[doadin]

Versions

• Pi-hole: v6.2.1
• Web: v6.3
• FTL: v6.3

Platform

• OS and version: debian 13 + docker

• Platform: Win 10 HyperV VM

Expected behavior

not reply with ip

Actual behavior / bug

replying with ips

this is what I see in logs
2025-10-25 21:07:40.531 query[HTTPS] mask.apple-dns.net from fe80::2c:243d:af1e:ea6
2025-10-25 21:07:40.532 forwarded mask.apple-dns.net to 127.0.0.1#5335
2025-10-25 21:07:40.532 query[AAAA] mask.apple-dns.net from fe80::2c:243d:af1e:ea6
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:a41:410::e
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:a41:40d::7
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:1360::6
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:a41:411::6
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:a41:410::8
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:a41:410::9
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:a41:40d::4
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 2620:149:a41:40d::6
2025-10-25 21:07:40.532 forwarded mask.apple-dns.net to 127.0.0.1#5335
2025-10-25 21:07:40.532 query[A] mask.apple-dns.net from fe80::2c:243d:af1e:ea6
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 17.248.136.169
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 17.248.136.165
2025-10-25 21:07:40.532 cached-stale mask.apple-dns.net is 17.248.186.39
2025-10-25 21:07:40.533 cached-stale mask.apple-dns.net is 17.248.186.103
2025-10-25 21:07:40.533 cached-stale mask.apple-dns.net is 17.248.186.101
2025-10-25 21:07:40.533 cached-stale mask.apple-dns.net is 17.248.186.40
2025-10-25 21:07:40.533 cached-stale mask.apple-dns.net is 17.248.186.45
2025-10-25 21:07:40.533 cached-stale mask.apple-dns.net is 17.248.186.71
2025-10-25 21:07:40.533 forwarded mask.apple-dns.net to 127.0.0.1#5335
2025-10-25 21:07:40.543 reply mask.apple-dns.net is NODATA
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:a41:410::b
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:1360::a
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:1360::7
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:a41:410::7
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:1360::9
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:a41:410::e
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:a41:410::4
2025-10-25 21:07:40.545 reply mask.apple-dns.net is 2620:149:a41:410::5
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.186.47
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.136.166
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.186.71
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.186.41
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.186.44
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.186.106
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.186.103
2025-10-25 21:07:40.592 reply mask.apple-dns.net is 17.248.186.72

if I ping from my windows PC it works. Doing a pihole search for mask.apple-dns.net gives 0 resaults and I have setting dns.specialDomains.iCloudPrivateRelay checked(enabled)

[rdwebdesign]

Please post a debug token:

• run pihole -d command.
• when asked to upload the log, answer Y.
• copy only the token and paste here.

[doadin]

https://tricorder.pi-hole.net/1s0YpKPG/

[yubiuser]

mask.apple-dns.net

is not listed as one of the private relay domains.

https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/

They might have changed it in between, but never announced it.

[doadin]

mask.apple-dns.net

is not listed as one of the private relay domains.

https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/

They might have changed it in between, but never announced it.

ah, i only googled the domain I did not check that site. That site only lists:
mask.icloud.com
mask-h2.icloud.com

resaults for apple relay online suggest also these are used:

mask.apple-dns.net
mask-api.fe.apple-dns.net
mask-t.apple-dns.net

[yubiuser]

Before we consider to add those to the special blocking mechanism, do you have a good source that those are used as canary domains to disable private relay on iOS?

[DL6ER]

$ dig mask.icloud.com @8.8.8.8

; <<>> DiG 9.18.39-0ubuntu0.24.04.2-Ubuntu <<>> mask.icloud.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45233
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mask.icloud.com.		IN	A

;; ANSWER SECTION:
mask.icloud.com.	7760	IN	CNAME	mask.apple-dns.net.   <-----------
mask.apple-dns.net.	48	IN	A	172.224.181.3
mask.apple-dns.net.	48	IN	A	172.224.46.8
mask.apple-dns.net.	48	IN	A	172.224.181.8
mask.apple-dns.net.	48	IN	A	172.224.181.9
mask.apple-dns.net.	48	IN	A	172.224.181.17
mask.apple-dns.net.	48	IN	A	172.224.181.4
mask.apple-dns.net.	48	IN	A	172.224.181.7
mask.apple-dns.net.	48	IN	A	172.224.181.6

;; Query time: 5 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Mon Oct 27 08:02:35 CET 2025
;; MSG SIZE  rcvd: 204

This alone is, of course, no sufficient indicator to say "blocking this is safe" as the domain may be used for other functionality that'd be blocked when we decide to add this domain.