But bigger risk is do they capture any confidential corp data in raw form for long enough to be part of a data breach

And I say that having mildly annoyed multiple network admins by doing the exact same thing... Thankfully they didn't really care as long as I kept it quiet.

Though after thinking about it a bit, it could also be looking for dnssec signatures? pi-hole necessarily has to break those to block things after all. I'd have to sniff every DNS request the phone makes to be sure (not particularly difficult with my network, but I don't have an iphone to actually do that with...) but it's entirely plausible for apple's "security focus" to forget that network administrators intentionally break it sometimes.

it should get you dragged out in the street and shot

Though I wonder exactly how pi-hole implements the blocking? Is it dropped requests, bogus nxdomain, or some other response? Because how intentionally malicious that "feature" is depends on how reasonable it is to see those blocks as network-level errors.

If it's responding with spoofed valid responses like nxdomain, or an empty "no error" response, there is no legitimate reason to query another resolver outside of bypassing dns-level blocking.

But if it's implementing the blocking by refusing queries for those domains rather than spoofing a 'valid' response, I could see a reasonable device interpreting it that as a broken resolver.

I use NextDNS, and they have a configuration profile that applies their DoH servers at the OS level regardless of which network I’m on. Still, I’m planning on switching to Pi-hole when my subscription expires, so this is good to know.

it’s also a fair bet that all ends of a WhatsApp chat are having their data exfiltrated by the WhatsApp client, because that’s what Facebook habitually does. that is how they make money.

a thing can look like it implements perfectly good encryption and still leak all the data that goes into it

like, we trust open source end to end encrypted systems because we can verify our end, and we can verify that the system mathematically doesn’t function unless encryption is happening as described, and we can assume that the other end isn’t mishandling data (or more accurately we can factor that into our threat model: the other side can be compromised, and we can’t necessarily solve that risk entirely technically)

we can’t verify any of that for iOS