If you’re having issues with ‘new siri’ saying “Uh oh there’s a problem” you need to turn off block bypass methods or manually allow *.mask-api.icloud.com

Will report this to NextDNS also however it seems block bypass methods is blocking *.mask-api.icloud.com which is now needed for new Siri.

Putting this on the whitelist fixes it and iCloud private relay is still blocked as the main mask addresses still are:

mask.icloud.com mask-h2.icloud.com 

Hope this helps someone! Was driving me crazy.