Apple Private Relay list question

[yyzguy]

Is the adguard/apple-private-relay.txt list something new? It appears to have been created 2 weeks ago and there's no mention in the readme.md. I have had problems with random delays using Safari on iPad and adding that list seems to have fixed it. I never saw anything in the logs suggesting there was a DNS problem. Was this list created to fix this particular problem? FWIW I had already disabled icloud private relay.

[yhay81]

Yes — it is new. The file history shows it was added on 2026-07-08 in commit 4ddf958, and the list header describes it as “Apple Private Relay/DNS Bypass.”

It is also a plausible explanation for the Safari delay you saw. The rules do two related things:

1. Return an explicit NXDOMAIN for Apple's Private Relay bootstrap names (mask.icloud.com, mask-h2.icloud.com, and mask-canary.icloud.com).
2. Return NXDOMAIN for Apple DoH/bypass names such as doh.dns.apple.com and _dns.resolver.arpa.

That behavior is visible directly in the list.

Apple's own network-operator guidance specifically says that, when Private Relay must be unavailable, the reliable way is to answer mask.icloud.com and mask-h2.icloud.com with either NODATA or NXDOMAIN. Apple warns that a DNS timeout or silently dropping relay traffic can cause delays on client devices: Prepare your network for iCloud Private Relay.

So the likely mechanism is:

• the iPad still attempted one of these paths;
• the previous network/filtering path failed slowly or intermittently;
• this list changed that into an immediate, deterministic NXDOMAIN, allowing Safari to fall back without waiting.

“Private Relay disabled” has two details worth checking:

• Turn Off Until Tomorrow automatically re-enables.
• The per-network Settings → Wi-Fi → ⓘ → Limit IP Address Tracking state matters; Apple documents that as the switch for Private Relay on that Wi-Fi network: Apple Support.

I cannot confirm the maintainer's exact motivation for creating the list, but technically it implements Apple's recommended no-delay blocking behavior, so your observed improvement is consistent with its purpose.

[yyzguy]

Thank you for your detailed answer. I did see it was created 2 weeks ago, but thought maybe the date was due to files being re-organized per this announcement.

I had indeed previously read the Apple Support document, but didn't think it applied to me as I had disabled Private Relay. I still don't fully understand the entire mechanism of how it's supposed to work or why Safari was still having random time-outs, but it sure seems like that list has fixed it. The delays are seemingly infrequent and random and I hadn't noticed the problem on Mac, just mobile.

Whatever the reason, this has solved a great annoyance ever since I started using DNS based blocking (not just AGH, but Pihole as well).

[hagezi]

Thank you for your support @yhay81

[yyzguy]

Sadly it seems the random delays have occurred again.

[hagezi]

@yyzguy Make sure you've turned off the “Protect IP Address and Mail Activity” feature in Safari's Privacy settings.

[Dynamic5912]

I don't believe this is a new list - I've been running it for quite some time now (months or more).

Question for @hagezi though - what is the private relay list in the "Share" folder?

[hagezi]

The list has been around for some time, but the repository is reinitialised at least once a month, at which point the file appears as ‘new’. The reinitialisation is necessary because otherwise the repository would become too large.

Share: For documentation and allowlist for ControlD folder.