Safari inspects your internet browsing even when it shouldn't?

Question

Level 1

15 points

Safari inspects your internet browsing even when it shouldn't?

Hello to everyone!

I try to ask you an information.. and I hope that you can help me.

I disabled all the Safati "Privacy & Security" options on my devices (iPad, iPhone and Mac) of my network because I don't want an Apple proxy between my devices and websites, but I see that even all the settings are disable, Apple still proxies the web requests.

For discovering it, I added to the DNS server of my network a record A that point www.google.com to the internal IP of my server and logged the DNS queries received from my devices... the expected behavior should be an error navigating to www.google.com

Well.. no.

If I browse to www.google.com from Chrome, Firefox or any other browser (but not Safari) I see correctly an error and I see the DNS requests logged on the DNS server of my network.

If I browse to www.google.com fromt Safari (iPhone, iPad or Mac) I see the original websites and I do not see the DNS request logged on the DNS server of my network.

I think that there's something wrong and worrying.

Could you please tell me what are the settings to use to avoid using Apple proxies on my Apple devices?

I already talked to Apple Support and they don't know how to help me (probably because the first level support is not so skilled concerning security and privacy).

I hope that I forgot something around the settings because if it's not... well... it's worrying... and that behavior should be reported to Apple due to privacy implications.

Thanks very much.

Best regards.

Andrea

MacBook Air

Posted on Jan 23, 2025 7:54 AM

Reply

Answer 1

Top-ranking reply

FishingAddict

Level 5

4,076 points

Jan 23, 2025 9:27 AM in response to theboz79

Two reasons where your local DNS would be ignored could be:

If your network supports IPv6, then DNS resolution may be occurring using IPv6 instead of your local IPv4 A record. I believe that you can go to the advanced DNS settings for the network of each device and reorder your DNS servers so that your IPv4 server has a higher priority.
Make sure that you have disabled iCloud Private Relay: About iCloud Private Relay - Apple Support

Reply

Answer 2

theboz79 Author

Level 1

15 points

Jan 25, 2025 3:19 PM in response to FishingAddict

Thank you very very much for your replies.

Unfortunately, that post is not the solution and does not explain the behaviour that I see.

For having the CNAME resolved, Safari has to query a DNS server for that specific domain and the problem is that Safari does not query the internal DNS even with all the security settings disabled.

For now I decided to implement PiHole in my network so I can block all the unwanted and undesired privacy uncompliant Apple traffic: in 12 hous about 13% of the total queries has been blocked because directed to Apple Private Relay sub-domains even if Private Relay is disabled.. and so my Apple devices are forced to use internal DNS.

Regards.

Andrea

Reply

Answer 3

Jan 25, 2025 1:00 PM in response to theboz79

I think that I may have found an answer to your question here: https://apple.stackexchange.com/questions/407975/safari-seems-to-ignore-my-dns-server

You could likely use the developer tools of a browser to dig into this further but that suggestion about CNAMEs seems likely.

Reply

Answer 4

Jan 23, 2025 3:56 PM in response to theboz79

Here is a post that I found that could be related to what you are seeing. It's about iOS but it should also apply to Safari in macOS:

ios17 private browsing overrides DNS - Apple Community

Reply

Answer 5

theboz79 Author

Level 1

15 points

Jan 23, 2025 11:25 AM in response to FishingAddict

Hi,

thank you very much for your quick reply.

Unfortunately:

as I wrote, the problem occurs only when browsing with Safari (not with other browsers such as Firefox) and the transmission of packets on IPv4 or IPv6 is at the operating system level (not at the browser level)
iCloud Private Relay is disabled

I really think that it is a (remarkable) privacy&security bug of Safari.. and I don't know how to submit it to Apple.

Regards.

Andrea

Reply

Answer 6

theboz79 Author

Level 1

15 points

Jan 23, 2025 11:43 AM in response to theboz79

Additional information

When I browse a site from Safari and only from Safari (with all the privacy&security settings disabled, also in the Wi-Fi settings) I see an IPv4 request to mask.apple-dns.net.. to demonstrate what was said before.

Wow.. not good!! :(

Andrea

Reply

Answer 7

theboz79 Author

Level 1

15 points

Jan 23, 2025 11:31 PM in response to FishingAddict

Thanks very much, but as I wrote I disabled all the security & privacy settings (even turned off “Advanced Tracking and Fingerprinting Protection” in Safari’s advanced settings) and Safari still does not use my internal DNS.

Best regards.

Andrea

Reply

Safari inspects your internet browsing even when it shouldn't?

Similar questions