What AdGuard Home Is

AdGuard Home is open-source, network-wide DNS filtering that you host yourself, usually on a machine on your own network or a small server you rent. Devices are pointed at it, names on the filter lists you enable stop resolving for them, and you get a web interface and a query log covering everything that uses it.

The design is network-first, which states the strength and the requirement in the same breath: something has to run it, and it has to be running whenever your network needs a name resolved.

Why People Look for a Mac Alternative

• •

  Nowhere to host it: no NAS, no home server, and no wish to leave a machine powered on for one service

• •

  Maintenance: another service to update, back up, and troubleshoot on the evening the network stops resolving

• •

  Scope mismatch: the real goal was a filtered Mac, not a filtered household

• •

  Mobility: a resolver on your home network is out of the path the moment the laptop is somewhere else

When AdGuard Home Is the Better Choice

• •

  You want every device on the network filtered, including ones you cannot install software on

• •

  You already run a NAS, home server, or router that can host it, so there is no new box and no new habit to build

• •

  You want to run the resolver end to end, including deciding what it uses upstream

• •

  You want a query log for the whole network, and the ability to allow a single domain when a list blocks something you need. SplitTunnel's curated lists are on or off, and individual domains can't be excluded in this version

That list is the honest case for keeping it. A Mac app cannot cover a smart TV, and it never will. If any two of those points describe your setup, the server is worth its upkeep.

The Same Layer, Without the Server

SplitTunnel works at the DNS layer as well, on the Mac. Lookups are processed locally on your Mac, and a domain on a curated list or in your own rules stops resolving, so the connection is never made.

• •

  Two curated blocklists from the HaGeZi project: Block Ads and Trackers, and Block Malware and Scams. Each has its own switch and both are refreshed daily

• •

  Your own domain rules alongside them, and a rule on a hostname also covers anything underneath it

• •

  Machine-wide on that Mac: every app and every browser, no matter how each app's traffic is routed

• •

  Lookups stay on the machine, so your queries are not sent anywhere to be classified

• •

  Nothing to host: no container, no router page, no upstream to choose, no service to keep awake

Rules and list settings survive a reboot and blocking resumes on its own, which covers the one thing people worry about when they give up a dedicated always-on box.

What a Native App Adds

Two things a network resolver structurally cannot offer, because from where it sits there are only names.

The first is attribution. The Activity panel shows which app on the Mac looked up which domain and where its connections are going. That is what turns blocking from guesswork into a decision: you block the domain you watched an app contact, rather than hoping a list author thought of it.

The second is per-app control. Choosing which apps use the VPN and which connect directly, or cutting one app off from the network entirely, are app-level decisions that a resolver has no way to make. Domain rules stay machine-wide, so the two controls stay separate: there is no "block this domain, but only for that app."

Both of those matter most at the moment a rule turns out to be wrong. Something stops working, and the useful question is which app wanted the domain and what else on the Mac is reaching for it. A network log answers that at the level of a device. Per-app attribution answers it at the level of the software that actually asked.

What You Give Up Without the Server

Set against that, here is the plain inventory of what a self-hosted resolver was doing for you that a Mac app does not.

• •

  Everything that is not this Mac: phones, tablets, TVs, consoles, and guests keep resolving whatever they always did

• •

  The household view: there is no single log covering every device, because there is no single point every device passes through

• •

  Upstream choice: you do not decide what the resolver uses upstream, in exchange for not having to run one

• •

  Per-domain exceptions on the curated lists: they are on or off, and individual domains can't be excluded in this version

None of that is hidden cost. It is the same trade stated from the other side: less reach, and nothing to keep running.

Set It Up

There is no upstream resolver to pick and no router page to visit. Blocking is running as soon as the switches are on, and it comes back by itself after a restart.

Encrypted DNS: The Limit Both Share

A browser or app that uses its own encrypted-DNS (DoH) provider bypasses whatever resolver the system is pointed at. Self-hosted, cloud-hosted, or running locally on the Mac, the lookup never reaches the filter. This is a property of the DNS layer itself, not a flaw in any one product, and it is worth knowing before you judge any of them.

Strict Mode is SplitTunnel's answer. Turn on Block Encrypted DNS in Settings and Strict Mode blocks known encrypted-DNS resolvers, so software falls back to the system resolver where your rules apply. Because it works from a curated list of resolvers, software hard-wired to one encrypted resolver stays out of reach.

Which to Pick

• •

  Whole network, somewhere to host it, and you enjoy running your own resolver: AdGuard Home

• •

  One Mac, no infrastructure, blocking that travels with the machine: SplitTunnel

• •

  Domain blocking plus per-app routing and per-app blocking in one app: SplitTunnel

• •

  Both: a network resolver for the devices that cannot help themselves, and a Mac app for the machine you actually work on

If you are already happy running AdGuard Home, nothing here is an argument to stop. It does something a Mac app cannot, and it does it well. This guide is for the other case, where the server was always a means to an end, the end was one filtered Mac, and the upkeep started to feel like the larger half of the project.