DNS Proxy stops responding to requests

[Adrian_Jensen]

Has anyone else recently experienced problems with DNS Proxy stopping responding to client DNS requests?

I run DNS Proxy on multiple sub-networks, such as our public Wifi zone, along with spyware/URL filtering for preventing access to malware/prohibited/etc. domains. The Security Policies prevent access to proxy avoidance and encrypted DNS. For the last week I have continually run into a problem were the public Wifi DNS Proxy stops responding to nearly all client DNS requests. Stopping/starting the the DNS Proxy temporarily restores service, but it fails again within a couple minutes to hours. Changing DNS cache settings has made no difference.

Under DNS Proxy statistics, "Queries forwarded to servers" is outnumbering "Queries received from servers" by 5-10 to 1. The DNS Proxy seems to start failing when "Pending UDP" connections climbs to around 2000 open queries.

It appears that these open DNS queries are being blocked in the security rules as proxy/encrypted DNS (expected) for "mask.icloud.com" (and other Apple-related FQDNs). It further appears that Apple changed their base config about a week ago to enable "iCloud Private Relay" by default, which has caused Apple devices to change from doing DNS requests for "mask.apple-dns.net" (which returns an A record) to DNS requests to "mask.icloud.net" (which returns a C record to mask.apple-dns.net). And the Apple devices are doing far more of these requests when blocked. It seems the combination of the C name and the increase in blocked requests is causing the DNS Proxy to hang and stop processing additional DNS queries.

I have been able to temporarily relieve the DNS Proxy hangs by inserting a "mask.icloud.com - 127.0.0.1" static DNS entry, but all the Apple devices can no longer access the internet unless the disable "iCloud Private Relay". Has anyone else experienced this? Any other options for bypassing while maintaining Security Policies?