My self-hosted ad blocker poisoned Apple's push servers and killed iMessage

Описание и применение

Самостоятельно развернутый блокировщик рекламы AdGuard Home в Docker случайно блокировал домены Apple Push, что привело к сбою iMessage. Решение включало добавление исключений для push‑доменов, сокращение списка фильтров и замену DoH‑поставщика.

Задача

AdGuard Home DNS filtering poisoned Apple’s push server domains, causing iMessage to fail after a short period.

Результат

iMessage functionality restored after allowlisting Apple push domains, trimming aggressive filter lists, and adjusting DoH upstreams.

Рабочий процесс

• 1. Run AdGuard Home in Docker and configure as network DNS.
• 2. Observe iMessage failure after ~30 minutes.
• 3. Diagnose DNS resolution: nslookup courier.push.apple.com returns 0.0.0.0 locally, 17.57.144.152 via 8.8.8.8.
• 4. Identify blocking rules: ||mask.icloud.com^ and ||mask-h2.icloud.com^ in privacy filter list.
• 5. Apply allowlist rules with @@ and $important for Apple push domains.
• 6. Reduce filter lists from 18 to 1 (AdGuard’s own).
• 7. Replace Quad9 DoH upstream with Google DoH next to Cloudflare.
• 8. Verify by comparing local and public DNS lookups and checking container logs for exchange failures.
• 9. Restart AdGuard container and wait for DNS proxy readiness.

Доказательства

nslookup courier.push.apple.com returned 0.0.0.0.

Источник

The rules doing it were explicit, ||mask.icloud.com^ and ||mask-h2.icloud.com^

Источник

First, allowlist rules in user_rules, one per domain, ten for Apple's push and identity stack

Источник