mask.apple-dns.net on iPhone: What It Is and How It Affects DNS Filters

Updated 15 Nov 2026

Version note: Checked on 9 Nov 2026 against Apple's iPhone User Guide page for iOS 18 and iOS 26 (the iOS 27 version of the page has the same Private Relay steps), Apple Support's "About iCloud Private Relay" and Apple Developer's "Prepare your network or web server for iCloud Private Relay". Menu names can change between iOS versions.

What we could and could not confirm about the hostname

You probably found mask.apple-dns.net in a router log, a DNS filter's query list or a network monitor, and wondered whether it is something to worry about.

Here is what Apple's Developer page says about hostnames. In its section for network operators it says that a network can stop Private Relay by returning a "no error no answer" or NXDOMAIN response from its DNS resolver "preventing DNS resolution for the following hostnames used by Private Relay traffic", and then lists:

• mask.icloud.com
• mask-h2.icloud.com

The name mask.apple-dns.net does not appear on that page, on Apple's "About iCloud Private Relay" support page, or on the iPhone User Guide page. However, Apple's "Use Apple products on enterprise networks" page says "Apple devices must be able to connect to hosts in the following domains to use iCloud services" and lists *.apple-dns.net, a domain that covers this name, as "DNS for iCloud services" (Apple added it in July 2026). That page does not name mask.apple-dns.net itself or say it is part of Private Relay. The name does share the "mask" label with the two hostnames Apple lists, and in our view that makes a Private Relay link plausible, but that is a guess, not something Apple's pages say. A quick way to test the guess is in the section on turning Private Relay off below: switch it off for the network and see whether the name stops appearing.

A router log shows names and times, not intent.

What iCloud Private Relay is

Apple Support describes it as follows: "iCloud Private Relay, part of an iCloud+ subscription, helps protect your privacy when you browse the web in Safari."

Apple's Developer page adds that it is "an internet privacy service offered as a part of an iCloud+ subscription" and that it "protects users' web browsing in Safari, DNS resolution queries, and insecure http app traffic." It says it works for users on "iOS 15, iPadOS 15, and macOS Monterey and later".

On how it works, Apple Support says: "When Private Relay is enabled, your requests are sent through two separate, secure internet relays." The first relay is operated by Apple and the second "by a third-party content provider". On DNS specifically: "Your DNS records are encrypted, so neither party can see the address of the website you're trying to visit."

It is an iCloud+ feature, so only people who subscribe can use it, and Apple notes that Private Relay "isn't available in all countries or regions".

How Private Relay relates to a DNS filter

A DNS filter works by answering the lookup for a blocked site with a refusal. If a lookup is encrypted and sent through Apple's relays, a filter on your home network or router may not see the name inside it. Apple's pages do not spell this out for any particular filter, and they do not say how a given filter, router or app is affected. So treat this as our reading of Apple's description, not a tested result for your setup.

Apple's Developer page does speak to networks that want to stop Private Relay: "Some enterprise or school networks might be required to audit all network traffic by policy, and your network can block access to Private Relay in these cases. The user will be alerted that they need to either disable Private Relay for your network or choose another network."

That is how some managed networks work. If you are on a school or workplace network and see a Private Relay message, the network's owner set that up, and the IT team is the right person to ask. This guide does not give steps to get around a network or device that someone else manages.

If you are checking your own filter, see DNS to Block Porn: Free Family DNS on Android, Step by Step for how DNS filtering works in general and Private Browsing, Incognito and Porn Blockers: What Gets Around What for how browsing modes interact with blockers.

How to turn Private Relay off or on

These steps are from Apple's iPhone User Guide page "Protect your web browsing with iCloud Private Relay on iPhone" (iOS 18 and iOS 26; the iOS 27 page has the same steps).

For all networks on this iPhone:

1. Go to Settings > [your name] > iCloud > Private Relay, then tap Private Relay.
2. To turn it off for a while, tap Turn Off Until Tomorrow. Apple says that "Within 24 hours, iCloud Private Relay will turn back on automatically."
3. To turn it off completely, tap Turn Off Private Relay.

To turn it back on, use the same path and tap Private Relay. Apple notes: "You need to turn on iCloud Private Relay on each device where you want to use it."

For one Wi-Fi network:

1. Go to Settings > Wi-Fi.
2. Tap the info button next to the network, then turn Limit IP Address Tracking on or off.

Apple warns that if you turn off Limit IP Address Tracking for a Wi-Fi network, "iCloud Private Relay is turned off for this network across all your devices where you're signed in to the same Apple Account."

For a cellular network:

1. Go to Settings > Cellular.
2. With a single line, tap Cellular Data Options. With multiple lines, select a line below SIMs.
3. Turn Limit IP Address Tracking on or off.

Apple says the cellular setting is specific to a physical SIM or eSIM in your iPhone.

A simple way to check the hostname (our suggestion)

1. Turn off Limit IP Address Tracking for that Wi-Fi network using the steps above.
2. Open Safari, browse for a minute, then look at the log again.
3. Turn it back on if you want Private Relay for that network.

If mask.apple-dns.net disappears, it is likely linked to Private Relay on your phone. If it does not, it may come from another device or service, and Apple's pages will not tell you which.

FAQ

Is mask.apple-dns.net malware?

Apple's enterprise networks page lists *.apple-dns.net, the domain this name sits in, among its iCloud hosts as "DNS for iCloud services". No Apple documentation page we found names mask.apple-dns.net itself or says exactly what it does. A name on a log is not proof of anything bad on its own.

Do I need Private Relay?

It is optional. Apple says you turn it on for each device, and you can turn it off for a single network.

Will Private Relay stop my website blocks from working?

Apple's pages do not say how any specific filter is affected. A block set in Screen Time or by a filter on the phone itself is a different thing from a filter on your router, and the only reliable answer is a test: add a harmless site to your own block list and see whether it loads. If a block on your phone shows a "not allowed" message you did not expect, see Website Not Allowed on iPhone? What the Message Means and How to Change It.

Does a VPN change any of this?

A VPN with its own DNS can get around a DNS filter. We cover that here: Porn Blockers and VPNs: How They Interact on Android and iPhone.

Where Mamori fits

Mamori is a newer app for iPhone, iPad (iOS 16 or later, App Store) and Android (Google Play) that blocks 2.5M+ adult sites across the whole phone, every browser and app. On iPhone it uses Apple's encrypted DNS setting: you switch it on once in Settings > General > VPN, DNS & Device Management > DNS, and then the app controls it. With Mamori, iPhone lookups go over encrypted DNS to Mamori's filtering server so adult sites can be blocked. On iPhone and iPad it can also switch on Apple's own automatic adult-website filter (the Screen Time "Limit Adult Websites" filter) through Apple's Screen Time framework.

We are not claiming how Mamori's server treats Private Relay hostnames or mask.apple-dns.net, because we have not found a source that says. If you use both Private Relay and a DNS filter, test your blocks as described above.

Honest limits: a VPN with its own DNS can get around a DNS filter on any phone. On iPhone, Mamori's uninstall guard uses Screen Time, which you can still turn off in Screen Time settings, so it is a speed bump rather than a lock-out. It has no accountability reports or partner alerts, and no blocker replaces support from people or a professional.

You can get Mamori from the App Store or Google Play on the homepage: mamoriblocker.com (7 days free on the monthly and annual plans, or a one-time lifetime option).

Related guides

Sources

• Apple Developer, Prepare your network or web server for iCloud Private Relay: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/
• Apple Support, About iCloud Private Relay: https://support.apple.com/en-us/102602
• Apple Support, iPhone User Guide, Protect your web browsing with iCloud Private Relay on iPhone (iOS 18 and iOS 26): https://support.apple.com/guide/iphone/protect-web-browsing-icloud-private-relay-iph499d287c2/26/ios/26
• Apple Support, Use Apple products on enterprise networks: https://support.apple.com/en-us/101555

Last checked 9 Nov 2026. This guide is general information, not medical advice.