Captive Portal Workaround using NextDNS Apple Profile

NextDNS is awesome, but I have been plagued by using the NextDNS Apple Profile whenever they encounter a Captive Portal. You know the one, it pops up at Starbucks, or school, or a hotel and demands you adhere to terms of service. Well, with the NextDNS profile installed on any Apple product, you would get the page in the microbrowser window but it would be blank. Agh! Why? NextDNS was doing its job and protecting you from a MITM (Man in the Middle) attack because that is what a captive portal is essentially. Well, you need to see that webpage though to get internet access. So, how to fix it?

A solution has been found! 

NextDNS updated its configuration generator at: apple.nextdns.io

In that generator for your apple devices, you can click "advanced" 

Under the section labeled "Excluded Domains" enter: 

mask.icloud.com, mask-h2.icloud.com, captive.apple.com

Generate the profile and install it.  

Go to your NextDNS page and under security tab turn OFF:  

-DNS Rebinding Protection- 

Go to the settings tab and turn OFF: 

-Block Page- 

Got to "Settings" on you Apple device and turn ON Internet Private Relay.

Now your NextDNS profile will work with captive portals at school, Starbucks, etc. 

Your NextDNS profile will also work with Apple Internet Private Relay (in iCloud settings) even though the setup tab on the NextDNS page will show that it is not. 

Why does this work? The excluded domains you entered in the profile are ones apple uses exclusively for captive portals and Internet Private Relay. What happens when you visit a captive portal is Apple uses the domain to check for an http connection. If it fails, it opens the captive portal sandboxed micro browser and attempts again. Because it is an excluded domain, your native DHCP will provide the DNS allowing the redirect. You are redirected to the captive portal and can log in. On the redirect, with Apple Internet Private Relay turned on, your computer will send a plain text request to mask.icloud.com OR mask-h2.icloud.com for the IP of the private relay. Because those are excluded, you will redirect via the native DHCP DNS to the captive portal page. After you connect, everything will work as normal with NextDNS blocking and your privacy protected by Apple Internet Private Relay. 

Hope this helps! I have been digging for a solution forever and this one works perfectly! Thank you NextDNS for updating your Apple Profile page!