Mail cannot function in IOS 18.2 if iCloud Private Relay is blocked at a network level
Hi Team,
As many of you are aware there are many use cases for blocking iCloud Private Relay at a network level. Most notably if using a DNS Filter like NextDNS, Pi-hole etc, or if on an enterprise network performing traffic inspection - as having private relay on bypasses these security controls.
According to Apple's own documentation the best way to force devices to disable private relay is as follows:
The fastest and most reliable way to alert users is to return either a "no error no answer" response or an NXDOMAIN response from your network’s DNS resolver, preventing DNS resolution for the following hostnames used by Private Relay traffic. Avoid causing DNS resolution timeouts or silently dropping IP packets sent to the Private Relay server, as this can lead to delays on client devices.
On these two addresses:
mask.icloud.com
mask-h2.icloud.com
However there is an issue. Ever since IOS 18.2 if you block these addresses the Mail App will not connect properly or download messages. Whitelisting these restores mail functionality but enables devices to use private relay / bypass security controls.
It's a poor experience for Apple Mail users, especially those who aren't aware of this, who just assume Mail is working poorly.
Apple - can you fix in a software update? I assume some recent change is loading part of mail through these - but it's painful for those of us trying to run a secure network!
