Are SVCB queries sent through pi-hole of blocking concern?

It looks like this is standard recent iOS and macOS behaviour when joining a new network. The Apple Developer video below explains what's going on (13:45 onwards for specifics). In summary, when a device joins a new network it sends a SVCB query for _dns.resolver.arpa to determine if the DNS server supports DDR. This informs as to the availability of secure DNS services.

I think in your case you are using Quad9 as your Pi-hole upstream? And since Quad9 supports DDR, you see this reply when you query localhost, since Pi-hole is acting as a stub for Quad9.

$ dig @9.9.9.9 _dns.resolver.arpa type64
...
;; ANSWER SECTION:
_dns.resolver.arpa. 60 IN SVCB 1 dns.quad9.net. alpn="dot" port=853 ipv4hint=9.9.9.9,149.112.112.112 ipv6hint=2620:fe::fe
_dns.resolver.arpa. 60 IN SVCB 2 dns.quad9.net. alpn="h2" port=443 ipv4hint=9.9.9.9,149.112.112.112 ipv6hint=2620:fe::fe key7="/dns-query{?dns}"
...

DoT or DoH via DDR discovery looks to be separate from iCloud Private Relay.

Private Relay is a dedicated service for paying Apple users where DNS is encrypted and routed through an Apple server and a third-party content provider server and assigned a temporary IP address, to disassociate the Apple device and IP from its queries, preventing tracking and increasing privacy. It can be turned off or on as needed.

Whereas DoT or DoH is availble wherever supported, and apparently now checked for on any new network joined.

So to your opening question, I don't think you need be concerned that these queries reveal your upstream DNS server because a) they can be revealed with any normal query too, and b) any app or device which might bypass your settings and use it could presumably do that anyway, eg with a Google server address.

When browsers do this kind of test they play nice and request a "canary domain" to flag that they are doing this. Pi-hole recognises these and can respond to disable DoH.

I'm not at all clear on what process an Apple device follows, or if it can be controlled, or how to prevent an application from making its own queries. Is there a setting to toggle DDR off? So I still think there is some concern to be had, mainly over how to have control over these various probes and defaults.

Sorry for rambling but DoH and DoT keeps cropping up in various ways and getting a clear understanding of what is and isn't going on is useful for reference.

2 Likes