Like many of you, I continue to see ads even when Connectivity Assist is disabled. According to this Apple Developer forum post:
Does "Connectivity Assist" bypass NEPacketTunnelProvider DNS interception on iOS 27? https://developer.apple.com/forums/thread/844177?answerId=903727022#903727022
tested different DNS servers, they respond in a different manner for a blocked domain, e.g.
NXDOMAIN
REFUSED
0.0.0.0
127.0.0.1
I noticed in cases (1-3), the system falls back to resolving the domain using cellular network (when Connectivity Assist is enabled). In case 4 it doesn't, but it's not something we want to do on the server side.
Case 4, corresponds to 127.0.0.1
In your pihole configuration, set your dns.blocking.mode
setting to IP.
In IP mode, blocked queries will be answered with the local IP addresses of your Pi-hole.
After changing this setting, iOS 27 no longer switches DNS requests to Cellular and PiHole continues to be used. (Even if Connectivity Assist is off, which the issue sounds like it’s a reported bug).
Source: r/pihole · by /u/brent20