Source: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/
Returning NXDOMAIN for the following two hostnames on 15.0 (19A5318f) results in the inability to resolve any hosts with iCloud Private Relay enabled without alerting the user that they need to disable iCloud Private Relay to continue.
All resolution just silently fails, other than those cached in the stub resolver.
- mask.icloud.com
- mask-h2.icloud.com
Is there a missing host on the list to block, or is this not working correctly yet?