iCloud Private Relay DNS & IP Leak (2026): How to Test Yours
Apple's iCloud Private Relay is often treated as "a VPN for Safari." In August 2026 that assumption took a hit: researchers Tommy Mysk and Talal Haj Bakry showed that a few WebKit features could send DNS lookups, or even a device's real IP, outside the relay. MacRumors and heise picked it up the next day. This post walks through what was reported, what Private Relay actually covers, how to check…
Apple's iCloud Private Relay, often compared to a VPN for Safari, experienced a setback in August 2026 according to researchers Tommy Mysk and Talal Haj Bakry. They found that certain WebKit features could still send DNS lookups and a device's real IP outside the Private Relay. MacRumors and heise reported on the findings the following day. This article explains what was revealed, how to verify your own Safari session, and what mitigations are still applicable.
In August 2026, Mysk published a report titled "IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay." The report detailed three WebKit features that could send traffic outside the configured proxy path. These features included DNS prefetching, WebAuthn-related origin requests, and WebTransport. Mysk noted that these bypasses affected iCloud Private Relay since they occurred outside WebKit's ordinary page-loading traffic.
Apple released updates in iOS/iPadOS 26.6.1 and macOS Tahoe 26.6.2 that addressed these leaks, making Private Relay leak-free in late 2026. However, it is essential to keep devices updated and verify your Safari session regularly.
Private Relay protects only Safari web browsing and related DNS, not every app on the device. It encrypts traffic and passes it through two separate internet relays, ensuring that no single party, including Apple, sees both the user's identity and browsing activity. The feature targets web browsing and not all apps on the device.
Other browsers, such as Chrome, are not affected by Private Relay. When testing Private Relay, it is crucial to separate DNS leaks, unexpected public IPs on ordinary HTTPS, and extra WebRTC candidates. These tests can be performed using free online tools such as ipdet.app and https://dnsleaktest.com/.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.