iOS device DoH\DoT bootstrap

[cyb3rz3us]

I know this isn't really an AGH related question but given the very knowledgeable community here, I thought I would ask anyway.

Because server IPs are not required in the mobileconfig file, does anyone know how an iOS device bootstraps the DoH\DoT connection? I'm not understanding how the device is able to resolve DNS requests until it first knows where to send the request. So there simply must be an IP address somewhere on the device that tells it where to resolve the DoH\DoT URL which then allows the device to continue forward with sending DNS requests to the DoH\DoT server IP.

But where is this IP? Is it supposed to use whatever DNS is provided via DHCP or manual config? I did test this and that doesn't seem to work. I've checked the relevant RFCs and it appears this is not part of the spec so it must be implementation specific...