This is a very late answer, but I found this question related to another question I posted.
The answer is: Yes, Private Relay DOES leak DNS Queries.
Private Relay isn’t as “private” as Apple claims it to be.
According to Apple's iCloud Private Relay Overview Document (Page 10) , "An unencrypted DNS server provided by a local network or manually edited in Settings (iOS) or System Preferences (macOS) will not be used for iCloud Private Relay traffic."
You can find the network's DNS Sever, or edit it, in Settings>Wi-Fi>Network Info>Configure DNS on iPhone, or System Settings>Wi-Fi>Network Details>DNS on Mac. Apple/Wireless Carriers generally don't show or allow users to edit the DNS Servers for Cellular Networks because the carriers need the device to use their DNS for special routing and technical purposes.
You can check Apple's claim that these DNS Servers are "not used" in some of the following ways:
- Conducting a Wireshark analysis
- Setting up your own DNS Server (Like PiHole) and observing the queries, or
- Easiest, replacing the existing DNS Servers with a service that gives you details about your DNS Queries, such as OpenDNS or AdGuard DNS.
If you do any of these things, you will find plain-text (unencrypted) DNS Queries from your Safari Browsing Activity to the servers that Apple claims are not used, from a user's originating IP Address (i.e. not an iCloud Private Relay one). This is a DNS Leak. Some DNS Leak Test sites have shown Private Relay users ISP or network DNS in the results, demonstrating there is a leak, but not all sites test in the same way.
It appears these leaked queries occur when the Private Relay DNS Service cannot find a record in the requested domain's zone. This includes NXDOMAIN Responses. For example, when a domain only has an A (IPv4) record, Private Relay will query the device's DNS Server (the ones in settings) for an AAAA (IPv6) record, and vice-versa, along with other records. These are generally not essential records. In most cases, the requested record(s) do not exist.
That is why you are being redirected to your ISPs "DNS Error Assist page", iCloud Private Relay attempted to query their ODoH service for google.cmo, and it returned NXDOMAIN/Domain Not Found, then the device/Private Relay tried querying your network's DNS Server for google.cmo, which, because it was your ISP's DNS Server and they offer this feature, returned an IP Address that directed you to it's Error Assist Page, instead of an NXDOMAIN. The second query was made unencrypted, and from your "original/true" IP Address. This is also probably why this issue only occurs on Wi-Fi and not cellular, because your Wireless Carrier probably doesn't offer this same "Error Assist" feature.
Does this mean all DNS queries are being leaked to my ISP? Or only invalid ones?
Not all DNS Queries, but some are. Even if you manually change the DNS Servers in settings, that is still unencrypted DNS, and the ISP can "see it", even if it's not their server responding to it.
As mentioned earlier, it does not appear to only be invalid queries, but even valid queries where it does not receive a record response, whether or not that record even exists.
Can AT&T associate my real IP address with the invalid DNS query, or are they still only seeing that a Private Relay address attempted an invalid DNS query?
Yes they can. These "leaked" DNS Queries are sent unencrypted and outside the Private Relay service to the DNS server listed in your device's DNS Settings. That DNS Provider (and everyone on the network between it) can see both your "real" IP address AND the queried domain.
If the DNS Server returns a publicly-routable address as a response (i.e. not a local network address or NXDOMAIN), Safari will attempt to make a connection, and that connection is supposed to load via Private Relay, whether or not that IP Address is actually correct for the domain.
However, see my other question here, as Private Relay doesn't always route all sites browsed in Safari through Private Relay as Apple says.
If the answer to question 1 is "yes" to the first option, is AT&T able to see all non-HTTPS connections even with Private Relay enabled?
If iCloud Private Relay successfully uses the two-proxy architecture in the way Apple says it does, and employs technologies like QUIC, TLS, etc., non-HTTPS Sessions in Safari are secured by Private Relay (if the connection actually goes through Private Relay, as to my other question above, and after DNS, but Apple claimed the DNS Queries were secure too). The Egress Relay (i.e. Cloudflare, Akamai, or Fastly) can "see" the unencrypted data, but not the ISP. Additionally, according to Apple's Developer Publications, iCloud Private Relay does not replace HTTPS encryption, it acts in addition to any existing TLS connection between client-website server.
Is there anything else I could test to determine if my DNS queries are being hijacked other than standard online DNS leak testing sites?
Yes, to prevent it, you can use an Encrypted DNS Setting (via a configuration profile) on your device to the DNS Provider of your choice. This will cryptographically validate your DNS queries and encrypt them while in transit. It also appears to remedy the iCloud Private Relay leak. The downside is that all DNS Queries (except for a few system level ones, which will still be sent to the network/edited DNS) will be sent via this method. The queries themselves will be encrypted, but you will not have ODoH support (at the time of writing very few, if any, easily-accessible DNS Providers support ODoH or ODoT), so the DNS Provider you chose will have access to both your IP Address and Queries, but nobody in between will be able to see the queries.
