# The Masking Function of iCloud Combined with pihole Blocking

**URL:** <https://discourse.pi-hole.net/t/the-masking-function-of-icloud-combined-with-pihole-blocking/60515>\
**Category:** Community Help\
**Created:** [January 16, 2023, 1:41pm UTC](https://discourse.pi-hole.net/t/the-masking-function-of-icloud-combined-with-pihole-blocking/60515 "2023-01-16T13:41:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Para\_Parasolian](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/para_parasolian/32/34431_2.png) [@Para\_Parasolian](https://discourse.pi-hole.net/u/Para_Parasolian)\
**Post date:** [January 16, 2023, 1:41pm UTC](https://discourse.pi-hole.net/t/the-masking-function-of-icloud-combined-with-pihole-blocking/60515/1 "2023-01-16T13:41:26Z")

</div>

In [New to Pi Hole why is mask.icloud.com blocked as standard? - #16 by ejwjohn](https://discourse.pi-hole.net/t/new-to-pi-hole-why-is-mask-icloud-com-blocked-as-standard/59707/16) there is a discussion on mask.icloud.com being blocked as a standard.

I wonder if (1) we can let pihole block all the domains it is set to block and then (2) forward those that pass through to the iCloud masker so that we get the benefit of both systems (pihole and mask)?

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [January 16, 2023, 4:41pm UTC](https://discourse.pi-hole.net/t/the-masking-function-of-icloud-combined-with-pihole-blocking/60515/2 "2023-01-16T16:41:23Z")

</div>

> [@Para\_Parasolian](#):
>
> I wonder if (1) we can let pihole block all the domains it is set to block and then (2) forward those that pass through to the iCloud masker so that we get the benefit of both systems (pihole and mask)?

When iCloud Private Relay is active, the queries from the Safari browser in MacOS go directly to third party servers, and don't go to Pi-hole.

The reason we block (more specifically, provide a NXDOMAIN response) to the two specific domains is to trigger IPR to not become active. This puts the Safari traffic on the same DNS server as the rest of your network.

It's essentially one or the other for Safari in MacOS - Private Relay or Pi-hole. They don't work in conjunction with each other.

As a result, you can't forward domains from Pi-hole to a service that is not active.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [February 6, 2023, 4:42pm UTC](https://discourse.pi-hole.net/t/the-masking-function-of-icloud-combined-with-pihole-blocking/60515/3 "2023-02-06T16:42:02Z")

</div>

Closed on February 6, 2023, 4:42pm UTC

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.