How iOS 15 Private Relay Encrypts DNS Requests

Apple’s iCloud Private Relay in iOS 15 secures domain name resolution (DNS) queries by employing an advanced cryptographic standard known as Oblivious DNS over HTTPS (ODoH) combined with a dual-hop network architecture. This design ensures that no single entity—including the user's internet service provider (ISP), Apple, or the destination network—can simultaneously link a user’s IP address to the domain names they are requesting.

In traditional network environments, when an application requests an IP address for a specific domain name, the query is typically sent in plain text to the local network's DNS server. This allows network eavesdroppers and ISPs to log every website and online service a user attempts to access.

Private Relay changes this process for supported traffic on iOS 15, which includes browsing in Safari, unencrypted HTTP traffic from third-party applications, and system-level DNS lookups. When an app initiates a connection to a domain, the operating system's networking stack encrypts the DNS query before it ever leaves the device.

The encryption process relies on Oblivious DNS over HTTPS (ODoH). Before transmission, the device encrypts the DNS query specifically for a dedicated DNS resolver using public key cryptography. This encrypted payload is then encapsulated within an outer encrypted layer directed toward an ingress proxy.

Once the request is transmitted from the device, it moves through two distinct architectural hops:

  1. The Ingress Proxy (Operated by Apple): The iOS device sends the encapsulated traffic to Apple’s ingress proxy over a secure TLS connection. At this stage, Apple can see the user's original IP address, which confirms their identity and network location. However, because the inner DNS query is encrypted with the resolver's public key, Apple cannot read the destination domain name.

  2. The Egress Proxy (Operated by Third-Party Partners): Apple forwards the encrypted packet to an independent third-party egress partner, such as Cloudflare, Fastly, or Akamai. The egress proxy strips the outer layer and routes the still-encrypted query to the designated ODoH resolver. The resolver decrypts the inner layer, resolves the domain name into an IP address, and sends the encrypted answer back through the same path.

Because the egress proxy and the DNS resolver only communicate with Apple’s ingress proxy, they never learn the user’s original IP address. Conversely, Apple never possesses the decryption keys to see the resolved domain. By fundamentally decoupling identity from destination, iOS 15 ensures that domain name resolution requests remain entirely private and cryptographically isolated from end to end.