After a recent update to my Pi-hole server, I'm now seeing the warning "Your network settings prevent content from loading privately" above email messages in the Mail apps in iOS/iPadOS 15.x and macOS v12 (Monterey) when I'm connected to my home Wi-Fi, preventing me from using the "Protect Mail Activity" feature in iOS 15.
Add a comment
|
1 Answer
Recent versions of Pi-hole automatically sink hole requests to two key Apple domains (mask.icloud.com and mask-h2.icloud.com) to prevent the Apple Private Relay feature from bypassing Pi-hole. Due to this, the "Protect Mail Activity" feature in iOS 15 may not work when connected to a network using a Pi-hole server.
In iOS, the "Protect Mail Activity" feature is found under Settings → Mail → Privacy Protection. In macOS, it's found under Mail → Preferences → Privacy.
To resolve this, add the BLOCK_ICLOUD_PR=false setting to your Pi-hole server's pihole-FTL.conf file using the following steps:
- SSH to your Pi-hole server
- Run the following command:
sudo nano /etc/pihole/pihole-FTL.conf - Append the following setting to this file and save the file:
BLOCK_ICLOUD_PR=false - Either restart your Pi-hole server, or just restart the DNS Resolver service with
pihole restartdns
Pi-hole documentation: BLOCK_ICLOUD_PR=true|false (PR #1171)
-
8
-
2It should be noted that this may cause traffic to bypass the Pi-hole, i.e., instead of more privacy you may actually get less. Tracking may be obscured though the privacy relay, however, telemetry sent by the Apps may contain sensitive information and will not be blocked anymore.– MrDNov 6, 2021 at 20:40
-
@MrD This is a very good point which I'd like to understand better. So what Apple's privacy relay does is anonymise/obscure loading of objects in emails (though I guess that doesn't help if the tracking pixels themselves are individualised?) but it does not prevent anything from being loaded (which is the aim of pihole). Is that correct? Can you point us to any resources related to this? Jun 29, 2022 at 10:30
-
1@Christoph I'm not sure which resources could be useful here but all your conclusions are already spot on. Tracking pixels are typically individualized, so the argument by Apple is some like "the sender cannot know if it was read because all tracking pixels will always be loaded" - which makes them less reliable as metric on one hand but giving wrong results upstream, on the other hand (like a collection agency thinks you have read the mail even when you didn't). I'm still convinced that bypassing what I wanted to get blocked isn't the right solution here.– MrDJul 1, 2022 at 13:12
-
©MrD Thanks for clarifying/confirming. But I think saying that Apple is bypassing "what I wanted to get blocked" is slightly misleading because it's not simply bypassing your pi-hole block list. What is bypassed or not depends on the content of the email/website, right? In that case, maybe it would be more accurate to say that Apple is opening loop holes for emails and websites to bypass your pihole. You may say, that ultimately that amounts to the same thing, but I think it's good to understand the difference. Jul 2, 2022 at 14:43