How iCloud Private Relay Encrypts DNS and Hides Your IP

This article explains the technical mechanisms behind Apple's iCloud Private Relay and how it enhances user privacy in the Safari web browser. Specifically, it covers how the service utilizes a dual-hop architecture to conceal your IP address and employs Oblivious DNS over HTTPS (ODoH) to encrypt your DNS queries, ensuring that neither Apple, your internet service provider, nor the websites you visit can link your identity to your browsing history.

The Dual-Hop Relay Architecture

Traditional VPNs route your traffic through a single server, meaning the VPN provider can see both your IP address and the websites you visit. iCloud Private Relay prevents any single entity from having this complete picture by splitting the routing process into two separate internet relays:

  1. The Ingress Proxy (Operated by Apple): The first relay receives your initial connection and knows your real IP address, but cannot see the website you want to visit.
  2. The Egress Proxy (Operated by a Third Party): The second relay, run by trusted content delivery networks, knows the website you want to visit, but does not know your real IP address.

How DNS Queries Are Encrypted

When you type a URL into Safari, your device must translate that website name into a numerical IP address using a Domain Name System (DNS) query. Normally, these queries are unencrypted, allowing your Internet Service Provider (ISP) to log every website you access.

iCloud Private Relay secures this process using a protocol called Oblivious DNS over HTTPS (ODoH):

  • Encryption at the Source: Before the DNS request leaves your device, Safari encrypts the query using a public cryptographic key belonging to the second relay (the Egress Proxy).
  • Stripping Identity: Your device sends this encrypted packet through an encrypted connection to the first relay (Apple). Because the DNS request is locked with the second relay's key, Apple cannot read the website name. Apple strips your real IP address from the metadata and forwards the encrypted DNS query to the second relay.
  • Resolving the Query: The second relay uses its private key to decrypt the DNS request, looks up the destination website's IP address, encrypts the answer, and sends it back through the Apple relay to your device.

Because of ODoH, your ISP cannot see the DNS request at all, Apple only sees that you made a request without knowing what it was for, and the DNS server processes the request without knowing who made it.

How Your IP Address Is Concealed

Once the DNS query is resolved, Safari needs to connect to the website. iCloud Private Relay masks your IP address during this connection so the destination website cannot track your physical location or build a profile based on your network identity.

  • Step 1: Connecting to Apple: Your device establishes a secure connection to Apple’s Ingress Proxy using the QUIC transport protocol. Apple authenticates that you are a valid iCloud+ subscriber and reads your real IP address.
  • Step 2: Tunneling to the Partner: Inside that first connection to Apple, Safari creates a second, nested TLS (Transport Layer Security) connection directed at the third-party Egress Proxy. Apple blindly forwards this encrypted tunnel to the partner relay without being able to read its contents, which contain the destination website's address.
  • Step 3: Assigning a Temporary IP: The Egress Proxy receives the tunnel from Apple, meaning it only sees Apple's IP address, not yours. The Egress Proxy decrypts the destination request and assigns your session a temporary, shared IP address. Depending on your settings, this IP address either reflects your general city (for local content) or just your country and time zone.
  • Step 4: Reaching the Website: The Egress Proxy connects to the website on your behalf. The destination website only sees the temporary IP address provided by the third-party relay, completely hiding your true network identity while delivering the web page back through the secure two-hop tunnel to Safari.