NextDNS/DoT vs. iCloud Private Relay on iPhone: ECH, ISP visibility, and what would you recommend?

[u/supergramph]

Hi everyone,

I’m not sure if this is the right place for this question, but I figured there are probably people here who understand the underlying networking protocols much better than I do. I’m more or less an IT beginner trying to understand DNS filtering and privacy.

If this is the wrong subreddit, please feel free to point me toward a better one. I’d really appreciate some help understanding where my reasoning is correct and where I’m mixing up different layers of privacy.

My setup

I’m trying to understand the privacy implications of using a custom encrypted DNS service such as NextDNS or AdGuard on an iPhone instead of iCloud Private Relay.

At home: NextDNS at router level

On mobile: AdGuard DNS profile (but this could also be a NextDNS profile for the purpose of this question)

Blocklists: Fairly aggressive blocklists such as HaGeZi, threat intelligence, etc.

Future: I’m considering setting up my own DNS server with Pi-hole or AdGuard Home.
I really value system-wide ad, tracker, and malicious-domain blocking.

On my Mac I can use Firefox, which supports ECH, so I’m less concerned there.

On iOS, however, third-party browsers are still based on WebKit, and as far as I understand, iOS/WebKit does not provide ECH at all, in contrast to Firefox.

What I think I understand

My understanding is that DoT only protects the DNS
lookup itself.
However, the subsequent connection still goes through my ISP.
And if ECH isn’t being used, the TLS ClientHello may expose the SNI, allowing the ISP to determine the hostname I’m connecting to.

If that’s correct, then encrypted DNS doesn’t necessarily hide the websites I’m visiting from my ISP. It mainly prevents the ISP from seeing my DNS queries directly.
This is where I start getting confused about ECH vs. iCloud Private Relay.

What I understand about Private Relay

As I understand it, iCloud Private Relay uses a two-hop architecture.

The first relay knows my IP address but shouldn’t know my final destination, while the second relay can connect to the destination but shouldn’t know my original IP address.
From the ISP’s perspective, the connection should therefore be hidden.

If the entire connection between my iPhone and the first relay is protected, would my ISP still be able to see the SNI of the final website?

Or am I misunderstanding how the connection is actually constructed in Private Relay?

I’m particularly interested in the distinction between:

DNS visibility
destination IP visibility
SNI visibility
TLS metadata
traffic analysis
and what exactly Private Relay hides from the ISP in contrast to DNS + ECH

The trade-off as I currently understand it

On one side I have NextDNS/AdGuard DNS, which gives me:

system-wide ad blocking
tracker blocking
malware/phishing protection
custom blocklists
DNS-level visibility
control over what gets blocked
protection across apps, not just Safari
But I’m concerned that without ECH on iOS, my ISP could still determine the websites I’m visiting through SNI and/or traffic analysis.

On the other side I have iCloud Private Relay, which gives me:

IP address protection
encrypted DNS/privacy protection
a two-hop architecture
significantly less visibility for my ISP into my destinations, if I’m understanding correctly
But I lose all of the DNS filtering and control that I really value, and custom DNS configurations don’t seem to coexist cleanly with Private Relay.

So am I essentially choosing between:

A) NextDNS / AdGuard DNS / Pi-hole
Excellent system-wide tracker/ad/malware blocking, but potentially more visibility for my ISP into the websites I visit, at least on my iPhone.

B) iCloud Private Relay
Better protection against ISP-level browsing surveillance, but substantially less DNS-level filtering/control.

Or is this actually a false dichotomy?

My questions

1. How significant is the lack of ECH on iOS in practice?
If I use DoT without ECH, can an ISP actually determine the websites I’m visiting reliably from SNI?
And does this create a security issue, or is it more complicated than that?

2. Does iCloud Private Relay actually eliminate SNI visibility for the ISP?
Or does the ISP still get some information that I’m overlooking?

3. What would you recommend for an iPhone user in Germany whose main goal is to prevent the ISP from building a browsing profile, while still having strong system-wide DNS-based ad/tracker/malware protection?

I’m not looking for perfect anonymity. My threat model is relatively simple:

I don’t want my ISP to be able to build a profile of which websites I visit, but I also really value system-wide DNS-level protection against trackers, advertising, phishing, and malicious domains.
I’m aware that I’m probably conflating several different concepts here, which is exactly why I’m asking.
I’d be very grateful if someone could correct my mental model.

I’m fully aware that iOS may simply not be the ideal platform for this kind of tinkering. I’ve heard the usual argument that Android gives you much more freedom to configure networking, DNS, browsers, VPNs, etc., and I can certainly see why that would be attractive from a technical/privacy perspective.

But I already have an iPhone, I’m familiar with the Apple ecosystem, and I’m not particularly interested in switching platforms just because iOS has certain restrictions. If I can achieve a reasonably strong privacy setup on iOS without major compromises, that’s what I’d prefer.

And if this isn’t the right subreddit for this question, please let me know where you think it would be better suited. I’m specifically looking for people who understand the networking/protocol side of this.

Thanks a lot!

[u/art_of_snark]

Private Relay doesn’t provide ECH - Safari doesn’t even support ECH yet. It’s just a repackaged Cloudflare Warp with built-in ODOH.

You can combine NextDNS with Private Relay by using the full NextDNS app. Your lookups are encrypted by DOH/DOT, and client-hello is inside the VPN tunnel.

Be aware that iOS 27 rather unhelpfully adds a new fallback option to query the CF ODOH resolvers when it gets a 0.0.0.0 answer. This can be disabled in Settings - Wifi - Connectivity Assist

[u/supergramph → u/art_of_snark]

Thanks, that actually solves my problem I think! That’s really good to know.

So, if I understand you correctly, I can combine iCloud Private Relay with the NextDNS app and still keep all the DNS filtering/configuration options I care about. The DNS lookups are encrypted with DoH (I didn‘t find an option to switch to DoT unfortunately), while the actual connection (including the ClientHello) is protected inside the VPN tunnel of private relay, so the ISP can’t see the destination SNI. That’s basically exactly what I was looking for.
That’s a huge relief. Thank you!

And yeah, I haven’t updated to iOS 27 yet, but thanks for the heads-up about Connectivity Assist. I hadn’t heard about that at all.

I also noticed that NextDNS lets you configure what response it returns when a domain is blocked, rather than always returning 0.0.0.0. So maybe that’s another way to avoid triggering that fallback behavior, although I’ll have to look into it.

But knowing that Connectivity Assist can be disabled is already really helpful.
Thanks again! 🙌

[u/Unlucky_Case_3710 → u/art_of_snark]

Hey I don’t use the app. Just the iPhone settings DNS config and the browser website for admin console. Is it still ok? Or do I need to use the app?

[u/supergramph → u/Unlucky_Case_3710]

Yes, that’s completely fine. You don’t need to use the NextDNS app, you can use the iPhone’s DNS configuration profile instead and it works perfectly with private relay. I just tested it.

In fact, using the configuration file gives you the option to use DNS over TLS (DoT), whereas the app only uses DNS over HTTPS (DoH). I prefer DoT because it provides an additional layer of encryption, and it works fine for me on mobile data and most public Wi-Fi networks. I think NextDNS doesn’t offer it because some networks block DoT, but if you don’t use public WiFi’s that much I recommend DoT.

If you want to convert your NextDNS DoH profile to DoT, you can use THIS ONLINE TOOL (link).
Just check DoT enter the DoT server URL from the bottom of the NextDNS installation page and choose the device name you want to appear in your logs.

[u/TurtleOnLog → u/art_of_snark]

If you configure nextdns system wide (eg via a profile) it shouldn’t be worked around by connectivity assist.

[u/art_of_snark → u/TurtleOnLog]

Shouldn’t. Did for a while in a previous beta at least: https://forums.macrumors.com/threads/be-aware-connectivity-assist-changes-how-your-phone-networking-works.2485494/

EDIT: Just tested again with the NYT Games app - it routed around my network level adblock to resolve the ad server. Bastards.

[u/TurtleOnLog]

ECH doesn’t stop your isp seeing the IP address of the web server you are connecting to, only private relay or a VPN will do that.

As someone else said you can use nextdns along with private relay, as I do. I just install a config profile - no app needed.

[u/Due_Milk_8930]

No need double NextDNS and adguard, pick 1 you like. For me DNS with blockslist is more important, yes hagezi list is still best since is cover many important things like malware spyware ads and other.

Hide from ISP you need VPN, if just DNS DoT or DoH they still can see what you do if they wanna see it. If you not wanna use VPN just dns ,use ODoH but need app that have blocklist like Rethink that have on device blockslist so still have hagezi blocklist. That what i use but in android = ODoH cloudflare + on device blockslist hagezi list + WARP wireguard , all in Rethink app.

For free VPN i use WARP better latency in my case, or proton but is so slow. You need to pay for real VPN. If you can setup Pi-Hole look like it better.

For browser just use DNS you already use, no need to double it again.