Where You Block Decides What It Covers

Blocking a website on a Mac sounds like one job, but the tools people reach for first each solve a narrower version of it. A browser extension blocks the site in that browser. A line in the hosts file blocks the exact name you typed and nothing beneath it. Every one of them works, and every one of them leaves a gap that opens the moment you launch a different browser or a different app.

• •

  Browser extensions: one browser at a time, and a second browser or a fresh profile walks straight past them

• •

  The hosts file: hand-edited in the terminal, exact names only, no coverage for the subdomains a site adds later

• •

  Screen Time: tied to a user account rather than to the machine, and aimed at web browsing rather than at everything apps do on the network

• •

  Router-level blocking: covers every device in the house, and does nothing once you take the laptop somewhere else

SplitTunnel takes the other position. It handles your Mac's DNS lookups, so a rule applies at the DNS layer, below the individual browsers and apps. Add a hostname under Domain Rules and the name stops resolving for the whole machine: every app, every browser, every background helper, and it does not matter whether that app's traffic goes out through a VPN or straight over your normal connection.

Two Ways to Add a Rule

There are exactly two routes, and they suit different moments. Use the Activity panel when you have just watched something reach a domain you did not expect. Use Domain Rules when you already know the name you want gone.

From the Activity panel

From Domain Rules

What Happens When a Domain Is Blocked

The name stops resolving. When any app on the Mac looks it up, the lookup fails, so the app never learns the address to connect to and the connection is never made.

In practice a browser shows its ordinary cannot-find-the-server page rather than a blocked-by-something warning, and a native app usually behaves the way it does when you have no network. There is no block page to click through and nothing announcing that a rule was involved, which is generally what people want: the site is simply not there. Domains you have not blocked keep resolving normally, so the rest of your browsing is untouched.

Subdomains Are Included Automatically

You do not have to enumerate hostnames. A rule on a hostname also covers anything underneath it, so a rule on example.com stops news.example.com, cdn.example.com, and whatever host the site starts using next month. This is the part hosts-file editing never gets right, because there every name has to be listed by hand and the list goes stale the moment the site changes.

Browsers That Use Their Own Encrypted DNS

Here is the honest limit. Some browsers and apps can send their lookups over encrypted DNS, known as DNS over HTTPS, to a provider they picked themselves rather than asking the system resolver. When that happens the lookup bypasses DNS-layer blocking altogether, and the site loads as if no rule existed.

The answer is in Settings, in the Strict Mode section: turn on Block Encrypted DNS. That blocks known encrypted-DNS (DoH) resolvers, so software that reached for one falls back to the system resolver, where your rules apply. It works from a curated list of resolvers rather than a promise about every one that exists: software that pins its own resolver by IP address stays out of reach.

That ceiling belongs to the DNS layer itself, not to SplitTunnel. Pi-hole, AdGuard Home, and a filtering resolver on your router all have the same blind spot for the same reason.

Rules Stay Put After a Reboot

Domain rules persist. They survive a restart of the Mac and blocking resumes automatically, so there is nothing to switch back on in the morning and no ritual to repeat after an update. Taking a rule away is the same single click in the other direction: open Domain Rules, find the entry, click Unblock.

When a Single Rule Is the Wrong Shape

Three neighboring jobs come up constantly, and reaching for a domain rule when you wanted one of these is the usual route to frustration.

• •

  A whole category rather than one site: Settings carries two curated blocklists, Block Ads and Trackers and Block Malware and Scams. Each has its own switch, both refresh daily, and both apply to every app. Individual domains cannot be excluded from them in this version

• •

  One app off the network entirely: that is the app-level block in the Apps panel, which cuts all of that app's traffic instead of one name

• •

  A site blocked for one app but allowed for the others: SplitTunnel does not scope a domain rule to a single app, so this is the one combination it does not do

Most setups settle on both halves working together: the curated lists handling volume quietly in the background, and a short list of your own rules for the specific things you decided your Mac should not be talking to.