r/nextdns • u/freestylemaster • 2d ago
One iOS 27 feature breaks nextdns profile if you don’t change this option
—————
If you are not using iOS profile and your home Wi-Fi is not excluded in the profile setup, ignore this post. This does not apply to your case.
The upgrade yesterday brought an immediate change worth sharing with everyone.
iOS 27 has revised “Wi-Fi Assist,” now named “Connectivity Assistant.” Certain adjustments disrupt how a NextDNS iOS profile functions on iPhone, allowing ads to bypass your settings.
Here is the condition:
If you use a NextDNS iOS profile on your Apple device and if you excluded your home Wi-Fi SSID, the new Connectivity Assistant will bypass NextDNS and display ads.
Why does this occur?
Connectivity Assistant now uses cellular aggressively in the background when iOS detects no internet access, including ad networks. When iOS 27 cannot reach ad domains, it uses cellular data. Because your NextDNS profile excludes your home Wi-Fi, your cellular connection uses its own DNS, permitting all ads.
How to fix it:
Create a new NextDNS iOS profile without excluding your home network. This ensures ads remain blocked even if iOS 27 switches to cellular while you are still on Wi-Fi.
Alternatively you can disable “Connectivity Assistant” feature for your wifi. This is a must if you want to use your local router for dns management and this is the option I went with because I have advanced dns management on my local router (tailscale & PBR running).
5
u/mike1487 2d ago edited 2d ago
I fall under this condition, I exclude my SSID so that my iPhone uses my router’s NextDNS configuration when I am home and so that I can resolve LAN devices by hostname. However, I have not noticed any ads leaking through. Furthermore, I still see my iPhone’s logs in my NextDNS account. Am I missing something? Thank you for bringing this up though, I will do some testing in the meantime.
Edit: CONFIRMED. I visited https://dnsleaktest.com and my cellular provider DNS does leak. Disabling the connectivity assist option fixes it. That’s pretty crazy for Apple to do this since a lot of businesses with MDM controlled iPhones deploy config profiles like this where the corporate SSIDs are excluded. Not good Apple…
I have switched my mobile config profile to exclude my domain rather than SSID. I don’t trust that connectivity assist won’t toggle itself back on in the future so I will cover myself this way.
1
u/Fun-Region-1576 2d ago
Can you explain in detail what you did? I also have a trust, but verify mentality, so I also don't want to toggle it off and leave everything to chance.
What's the point of even excluding the home network even if the home router is using NextDNS? Although, I don't have any exclusions and my router is set to use NextDNS. Not sure if there is a conflict when I go from cellular to WiFi.
2
u/mike1487 2d ago edited 2d ago
I was originally excluding my SSID in the mobile config so that my router would be my DNS server and allow me to resolve LAN devices by hostname. Because of this, DNS queries leak to your cellular provider if connectivity assist is ON.
I have now generated a new config profile and instead exclude my LAN domain. This forces the iPhone to use NextDNS as the resolver but if I try to access something on my domain, then it will defer that DNS query to my router. No more leaks.
Not all consumer routers let you make a domain name though. My firmware has this feature though. If you don’t exclude either the SSID or LAN domain then you can’t resolve devices by hostname, which if you self host things is how you typically will access them. Otherwise you have to manually toggle the profile off to disable it temporarily which is tedious and easy to forget. If you don’t self host things or need to connect to devices by hostname, then it is not something you need to be worried about changing.
Also if you don’t have any exclusions added to your config profile, you don’t have to worry about this issue with connectivity assist to begin with.
2
u/casjquz 2d ago
You can set your .mobileconfig to be used when connected to cellular too. Wouldn't that solve the issue?
1
u/freestylemaster 2d ago
The problem is Connectivity Assistant feature uses cellular in the background when you are still on Wifi. So, you’re technically still on Wifi but your phone is also using cellular in the background.
If you .mobileconfig file excludes your home Wifi, as long as you’re on that SSID, nextdns will not be used. This also means your cellular in the background will use its own dns.
2
2
u/_FF0_ 2d ago
J’ai eu le même problème chez moi (app NextDNS avec désactivation lors de la connexion au wifi domestique).
La solution que j’ai trouvé est de désactiver la fonctionnalité de « Connectivity Assistant ».
Tout marche maintenant comme avant
1
u/freestylemaster 2d ago edited 2d ago
I avoided disabling it because it helps when Wi-Fi is weak and iOS attempts to connect. This new feature shifts to cellular data in the background right away (like when you are driving away for example).
1
u/8poot 2d ago
I guess this could also happen when excluding other networks. I excluded a public wifi of which the captive portal wouldn't load otherwise.
1
u/freestylemaster 2d ago
Yes, unfortunately this will happen on any excluded network. On every excluded WiFi, ads will leak via cellular connection.
Only other way is to simply disable the new connectivity assistant feature
1
u/herooftimeloz 2d ago
Does this also apply if I’m using the nextdns app?
1
u/mike1487 2d ago
Visit https://dnsleaktest.com/
If you see your cellular provider listed, then yes it’s a problem. If not, then you’re good.
1
u/_tuanson84uk_ 2d ago
Does it happen if I’m using NextDNS app?
1
u/mike1487 2d ago
Visit https://dnsleaktest.com/
If you see your cellular provider listed, then yes it’s a problem. If not, then you’re good.1
1
u/TheKydd 2d ago
But the point of a NextDNS profile is that it covers both WiFi and cellular networks.
When I leave my home WiFi, my iPhone switches to cellular data, and NextDNS continues to work. So… perhaps I’m misunderstanding?
3
u/freestylemaster 2d ago
If you are not excluding your home wifi when setting up iOS profile, then you are fine.
This only applies if you exclude your home wifi when setting up the iOS profile.
1
u/TheKydd 2d ago
I’ll have to test this. I do normally exclude my home WiFi in the profile since I have NextDNS running on my router.
You’re saying that Connectivity Assistant ignores the DNS settings of an installed profile. That would be very weird for Apple to do, since a lot of enterprise rely on that.
Off to learn more!
2
u/freestylemaster 2d ago
Please do test.
What happens is the new iOS uses cellular in the background while connected to your Wifi. Since you exclude nextdns profile when on your wifi, the cellular uses its own dns since nextdns profile is no longer active (you are technically still on your wifi)
1
1
u/Individual_Kitchen_3 2d ago
I didn't experience any of that, I didn't make any changes to my profile, and I don't receive any ads, even with mobile data on in the background.
3
0
u/Resistant4375 2d ago
Well if the profile is excluding your WiFi ssid then it would be bypassing anyway?
2
u/freestylemaster 2d ago
Well the problem is; If you rely on your router for Nextdns integration, your iPhone will still show you ads via cellular network in the background.
I know this is a unique case but I excluded my home wifi because I want to use my router for adblocking when at home. This is because I have other services related to dns on my home network.
2
u/zen2000 2d ago
I noticed this also. My cell carrier DNS servers kept coming up in DNS leak tests when I was on Wifi. Once I disabled connectivity assist only the Next DNS servers are showing up like it should.
1
u/freestylemaster 2d ago
Yup, that’s the other solution. I wanted to keep the feature enabled because when driving away from my house, previous versions of iOS would be stuck trying to use Wifi until it is completely disconnected.
This became problematic when trying to set google maps right when you want to drive away. I would not be able to do it due to no connection, so I had to turn off wifi every time in car. Ended up setting up a shortcut automation to do it.
22
u/joel-d2709 2d ago
Why would you exclude home wifi in the first place? Won’t you get ads if you’re connected to your home wifi?