My self-hosted ad blocker poisoned Apple's push servers and killed iMessage

说明与用途

在 Docker 中自托管的 AdGuard Home 不小心阻止了 Apple Push 域名，导致 iMessage 无法工作。解决方案包括为推送域名添加白名单、精简过滤列表并调整 DoH 上游。

问题

AdGuard Home DNS filtering poisoned Apple’s push server domains, causing iMessage to fail after a short period.

结果

iMessage functionality restored after allowlisting Apple push domains, trimming aggressive filter lists, and adjusting DoH upstreams.

工作流

• 1. Run AdGuard Home in Docker and configure as network DNS.
• 2. Observe iMessage failure after ~30 minutes.
• 3. Diagnose DNS resolution: nslookup courier.push.apple.com returns 0.0.0.0 locally, 17.57.144.152 via 8.8.8.8.
• 4. Identify blocking rules: ||mask.icloud.com^ and ||mask-h2.icloud.com^ in privacy filter list.
• 5. Apply allowlist rules with @@ and $important for Apple push domains.
• 6. Reduce filter lists from 18 to 1 (AdGuard’s own).
• 7. Replace Quad9 DoH upstream with Google DoH next to Cloudflare.
• 8. Verify by comparing local and public DNS lookups and checking container logs for exchange failures.
• 9. Restart AdGuard container and wait for DNS proxy readiness.

证据

nslookup courier.push.apple.com returned 0.0.0.0.

来源

The rules doing it were explicit, ||mask.icloud.com^ and ||mask-h2.icloud.com^

来源

First, allowlist rules in user_rules, one per domain, ten for Apple's push and identity stack

来源