Apple devices are required to verify that mask.icloud.com and mask-h2.icloud.com are reachable, even if iCloud Private Relay is disabled.

If you use mobileconfig profile, this query is done on System DNS (not on DNS in profile).

This introduces a delay of at least 8 seconds in the native mail app for receiving a message, even if NXDOMAIN is returned, in devices uses FS as resolver on upstream (for example on wifi). It also delays attachment verification.

This is well documented by Apple and verifiable.

It is requested that this domain be independently unlocked for individual profiles (for example, by setting the "Enable iCloud Private Relay" flag, which is off by default).