The Two Names to Add

YouTube is unusually simple to block, because nearly everything a person reaches it by runs under two names.

• •

  youtube.com: the site itself, and every host underneath it

• •

  youtu.be: the short-link domain. This is the one people forget, and it is the one that catches you, because links shared in chat apps and documents use it

They are separate domains, so they need separate rules. Two entries, half a minute, done.

One Rule, Every Browser and Every App

SplitTunnel handles your Mac's DNS lookups, so a rule applies at the DNS layer, below the individual apps and browsers. Add a hostname under Domain Rules and the name stops resolving for the whole machine: every app, every browser, every background helper, no matter whether that app's traffic goes out through a VPN or straight over your normal connection.

It also reaches video embedded somewhere else. Most embedded players load from a host underneath youtube.com, so they go down with the site and the page carries on with an empty box where the player was. Worth knowing in advance, because embedded video turns up in documentation, course pages, and news articles you never thought of as YouTube. A few sites embed from a separate privacy-focused domain, which is its own name and would need its own rule.

What you see is plain. The name stops resolving, so a browser shows its ordinary cannot-find-the-server page rather than a blocked-by-something warning, and there is no block screen to click through. Domains you have not blocked keep resolving normally, so the rest of your browsing is untouched.

Add Them

What the youtube.com Rule Takes With It

You do not have to enumerate hosts. A rule on a hostname also covers anything underneath it, so the mobile host, the music host, and the TV host are included by that single entry, along with hosts that did not exist when you wrote it. This is the part that hosts-file editing never gets right, because there every name has to be listed by hand.

For most people that is an acceptable price, or even the point. If it is not, the honest options are to accept the loss, or to leave YouTube alone and block something else in the chain of habit that leads you there.

Do Not Reach for the Parent Domain

The tempting move, when a video still plays somewhere, is to go one level up and block something broader. Resist it. Blocking a parent domain to stop one host underneath it takes the rest of that domain with it, sign-in and content included, and the company behind YouTube runs mail, search, calendars, and account sign-in on names you rely on all day. The damage lands somewhere you did not intend and it is not obvious why.

The narrow rule is the right instinct here. Block the specific name you saw, and if that is not enough, add the next specific name.

If Something Still Plays

Large platforms serve video from a number of hosts, and not all of them are named in a way you would guess. You do not have to guess. Activity shows which app looked up which domain, so open it, reproduce the thing that still works, and read the names your Mac actually asked for. Add the ones that clearly belong to the service.

Treat that as a short list rather than a campaign. Two rules cover ordinary use, and a third is occasionally worth adding once you have seen it with your own eyes rather than copied it from someone else.

When a Rule Looks Ignored

• •

  Software on encrypted DNS: a browser that sends lookups over DNS over HTTPS to its own provider bypasses DNS-layer blocking. Turn on Block Encrypted DNS in the Strict Mode section of Settings and it falls back to the system resolver, where your rules apply. It works from a curated list of resolvers, so software that pins its own resolver by IP address stays out of reach

• •

  A tab that was already open: reloading is not always enough. Quit the browser and start it again after adding a rule or switching on Strict Mode

The first of those is not specific to SplitTunnel. Every DNS-layer blocker shares it, Pi-hole and AdGuard Home included, and it is worth knowing before a rule looks mysteriously broken.

Undoing It

Rules persist. They survive a restart of the Mac and blocking resumes automatically, so a rule you added once stays a rule until you take it away. Removing it is a single click: open Domain Rules, find youtube.com, click Unblock.

That is the honest deal on offer. This is coverage rather than a lockout: it reaches every browser and every app on the machine, and it is one click away from being gone. If what you need is a block a future you cannot lift, a commitment tool with scheduled lockouts is the right category to shop in.