How iCloud Private Relay Protects Safari on iOS 15

Apple introduced iCloud Private Relay in iOS 15 to enhance privacy during Safari web browsing by implementing a dual-hop architecture that separates user identity from browsing activity. Under this system, no single entity—including Apple, internet service providers (ISPs), or destination websites—can view both who a user is and which websites they are visiting. By decoupling Domain Name System (DNS) queries and IP address routing through two independent relays, the feature ensures comprehensive anonymity without disrupting typical browsing performance.

The Traditional Browsing Vulnerability

In standard web browsing, a user's device sends unencrypted or semi-encrypted DNS requests and IP data directly through their local network and ISP. The ISP can observe every domain the user accesses, allowing them to log history or build advertising profiles. Concurrently, the destination website receives the user’s real public IP address, which reveals geographic location and can be tied to persistent tracking identifiers across the web.

The Two-Hop Architecture: Splitting Identity and Destination

iCloud Private Relay neutralizes these tracking methods by breaking the connection into two distinct stages handled by separate entities using secure protocols, primarily QUIC and Oblivious DoH (DNS over HTTPS).

1. The Ingress Relay (Operated by Apple)

When a user navigates to a website in Safari on iOS 15, the request is encrypted on the device before it leaves the local network.

  • What it sees: Apple’s ingress server receives the request and can see the user's original IP address, which confirms their identity and device network.
  • What it cannot see: Because the destination URL and DNS queries are encrypted inside an inner layer on the device, Apple cannot see the website the user intends to visit.

The first relay strips the user's connection details, validates their iCloud+ entitlement, and passes the encrypted payload to the second relay.

2. The Egress Relay (Operated by Third-Party Partners)

The second relay is managed by independent third-party content delivery networks (such as Cloudflare, Fastly, and Akamai) rather than Apple.

  • What it sees: The egress server decrypts the inner layer containing the DNS query and destination web address to establish the final connection to the target server.
  • What it cannot see: It receives the traffic exclusively from Apple’s ingress relay, meaning it never sees the user’s original IP address.

This second relay assigns an anonymous, shared IP address that maps only to the user's general geographic region (such as their city or country, based on user preferences). The website receives the request from this temporary IP address, preventing the site from discovering the user's true location or identity.

Why This Separation Matters

The fundamental security benefit of Private Relay lies in this strict division of information:

  • Apple knows your identity (IP address) but does not know your browsing destination.
  • The Third-Party Partner knows your browsing destination, but does not know your identity.
  • Your ISP and Network Operators only see encrypted traffic traveling to an Apple relay, blinding them to your DNS queries and browsing targets.
  • Websites receive traffic from a rotating, regional proxy IP, preventing cross-site tracking and fingerprinting.

By isolating IP routing from DNS resolution across two non-colluding entities, iOS 15 removes the single point of trust inherent in traditional Virtual Private Networks (VPNs) and secures Safari browsing directly at the operating system level.