⚠️ iOS 27 / iPadOS 27: "Connectivity Assist" bypasses your local DNS

[hagezi]

⚠️ iOS 27 / iPadOS 27: "Connectivity Assist" bypasses your local DNS

Status: confirmed on the final release (iOS 27.0, released 14 September 2026)
Who this affects: anyone filtering DNS locally (Pi-hole, AdGuard Home, router DNS, any resolver handed out by DHCP)
Can blocklists fix it? No!

---

What's going on

iOS 27 renamed the old Wi-Fi Assist feature to Connectivity Assist and moved it from
Settings > Cellular to Settings > Wi-Fi. It's on by default, also after you update from
iOS 26.

The old feature only switched to cellular when your Wi-Fi was struggling. The new one uses cellular
in addition to Wi-Fi. That means your iPhone talks to your carrier's DNS servers and to the DNS
server from your router at the same time, while you're on Wi-Fi.

So some of your DNS queries never reach your local resolver. They go straight out over cellular to
your carrier instead. Blocked domains resolve, ads show up again, and you won't find anything in
your query log, because the query never got there.

What the tests show

Setup	Result
Connectivity Assist on, no DNS profile	Carrier DNS used next to your local DNS. Leak.
Connectivity Assist on, encrypted DNS profile for cellular only	Carrier DNS still used on Wi-Fi. Leak.
Connectivity Assist on, always-on encrypted DNS profile	No leak, but only the resolver from the profile is used. Your local DNS is skipped completely.
Connectivity Assist on, VPN to your home network, DNS traffic only (split tunnel)	Leak. Same with WireGuard and with Tailscale.
Connectivity Assist on, VPN to your home network, full tunnel	No leak. Local DNS works.
Connectivity Assist off	Local DNS works normally. No leak.

Take a close look at the third row. An always-on encrypted DNS profile does stop the leak, but it
stops it by taking your local resolver out of the picture. If your filtering runs on a Pi-hole or
AdGuard Home in your network, that's not really a fix. You just swapped one bypass for another.

And look at the split tunnel row too, because that's the workaround most people try first. Routing
just your DNS traffic home through WireGuard or Tailscale does not help. The queries that go out
over cellular never enter the tunnel, so a rule that only catches DNS inside the tunnel never sees
them. Only a full tunnel catches everything.

How to check your own device

Open https://dnscheck.tools on your iPhone and look at which resolvers show up. If you see
servers from your mobile carrier while you're on Wi-Fi, you're affected. Turn Connectivity Assist
off, reload the page, and compare.

What you can do

Turn Connectivity Assist off (easiest)

There are two switches and both of them work:

• Global: Settings > Wi-Fi > Connectivity Assist. Turns it off everywhere.
• Per network: Settings > Wi-Fi > [your network] > Use Connectivity Assist. Turns it off for
  that one network only.

Tested on the final release:

Global switch	Per network switch	Result
on	on	Leak
on	off	No leak
off	on	No leak
off	off	No leak

The leak only happens when both are on, so either switch is enough to stop it. However, it is recommended that you turn off the global switch.

[dasICH74]

Connectivity assist goes even further:
Follow the steps described above but open your active WiFi connection, it has an additional/seperate connectivity assist slider per known WiFi connection.
This will be active/stay active despite being disabled in WiFi settings as described above

[hagezi]

Update:

There are two switches and both of them work:

• Global: Settings > Wi-Fi > Connectivity Assist. Turns it off everywhere.
• Per network: Settings > Wi-Fi > [your network] > Use Connectivity Assist. Turns it off for
  that one network only.

Tested on the final release:

Global switch	Per network switch	Result
on	on	Leak
on	off	No leak
off	on	No leak
off	off	No leak

The leak only happens when both are on, so either switch is enough to stop it. However, it is recommended that you turn off the global switch.

[reserve85]

Thanks for the hint, I was already wondering yesterday why I’m seeing ads on my iPhone… Your discussion here helped me out!
Thank you very much!

Why is apple implementing a 'bypass' - no one needs it... i seached 1h in the pihole logs why i see ads... everything was blocked but i didn´t know about the activated bypass...

[kRYstall9]

What about having tailscale(selfhosted headscale specifically) routing all the traffic to your local dns? It would work on either Wifi or Cellular

[hagezi]

I can't test Tailscale, but with a WireGuard VPN connection to my home network, there's also a leak when the Connectivity Assist is enabled and only DNS traffic is routed through the tunnel.

[kRYstall9]

Tested with Tailscale and yes, you're right. When the connectivity assist is enabled, leak happens. Switching off the new option solves the problem

[luckmagnet]

Perhaps thou mightst consider letting https://dnsleaktest.com wear thy mantle, where https://dnscheck.tools now rests?

[hagezi]

Why?

[Dynamic5912]

What?