It does with encrypted DNS (I think - still mid setup). If you use a configuration profile [0] to explicitly set a DNS over HTTPS or DNS over TLS server this is

It does with encrypted DNS (I think - still mid setup). If you use a configuration profile [0] to explicitly set a DNS over HTTPS or DNS over TLS server this is still honoured within private relay. IMO vanilla private relay is much neater and simpler if privacy is your goal. It uses Oblivious DNS over HTTPS [1] which is pretty neat. To trade some of that privacy to reduce ads setting up encrypted DNS restores filtering control. This does mean you then need to funnel those queries somewhere likely less oblivious though. Current setup I'm playing with in the homelab uses Adguard Home for filtering. This then forwards to a local Unbound instance acting as a recursive resolver with strict DNSSEC [2] and QNAME minimisation [3]. End result is the DNS traffic is still open, but does not all go to any one single entity (apart from my ISP, which can see TLS SNI anyway). [0]: https://dns.notjakob.com https://dns.notjakob.com [1]: https://datatracker.ietf.org/doc/html/rfc9230 https://datatracker.ietf.org/doc/html/rfc9230 [2]: https://datatracker.ietf.org/doc/html/rfc7816 https://datatracker.ietf.org/doc/html/rfc7816 [3]: https://datatracker.ietf.org/doc/html/rfc9364 https://datatracker.ietf.org/doc/html/rfc9364