How to Block a Domain on Mac
Which Name to Block, and What It Covers
Key Takeaways
A rule on a hostname also covers anything underneath it, so one entry on a parent domain takes every host beneath it with it
Rules apply to the whole Mac at the DNS layer. There is no version that blocks a domain for one app and allows it for another
Add a name under Domain Rules, or block one you just saw in the Activity panel. Rules persist across reboots and Unblock reverses them
What a Domain Rule Covers
A domain rule is a rule on a name. Add one and that name stops resolving for the whole Mac, which is why the interesting question is not how to add a rule but which name to put in it.
The part that saves the most work is that coverage extends downward on its own. A rule on a hostname also covers anything underneath it, so you never have to sit and enumerate hosts:
- •
A rule on example.com covers example.com and every host beneath it, including ones that did not exist when you wrote the rule
- •
That means api.example.com, cdn.example.com, and whatever a site starts using next month are all handled by the one entry
- •
It does not reach sideways. A separate domain is a separate rule, which matters for large sites that own several unrelated names
Automatic subdomain coverage is the practical difference between a domain rule and a line in the hosts file. In the hosts file every name has to be listed by hand, and the list is stale the moment the site adds a host.
Pick the Narrowest Name That Does the Job
Because coverage runs downward, the level you choose is the whole decision. Blocking a parent domain is blunt and thorough. Blocking a single host is precise and leaves everything else alone.
- •
If you want a site gone entirely, the parent domain is the right entry and one rule finishes the job
- •
If you want one endpoint gone while the rest of the site keeps working, block the specific host you saw and nothing above it
- •
If you are not sure yet, start narrow. Widening a rule later is a second entry, but recovering a service you accidentally cut off is a worse afternoon
Blocking a parent to stop one host underneath it takes the rest of that domain with it, sign-in and content included. When the rest of the site still has to work, block the specific name.
Finding the Name in the First Place
Guessing at hostnames is how people end up with rules that do nothing. The Activity panel removes the guessing: it shows connections along with the app that made them and the domain each one looked up, so you are reading names off your own machine rather than off a list someone published two years ago.
Open the app you are curious about, leave it running for a few minutes, and read what shows up. Names carrying analytics, telemetry, metrics, or events are the usual candidates when you are hunting background chatter rather than blocking a site you already know.
Adding and Removing a Rule
Install SplitTunnel and start the tunnel, then open Domain Rules in the sidebar
Click Add Domain and type the name, for example example.com
Click Block. The rule takes effect immediately
To reverse it, find the entry in the same list and click Unblock
The other route is the one you use when the name came from Activity. Select a connection there and the detail pane offers Block followed by that domain, which then reads Unblock. Both routes write to the same Domain Rules list.
What a Live Rule Looks Like
The domain stops resolving. Any app that looks it up gets a failed lookup, so it never learns the address to connect to and the connection is never made. A browser shows its ordinary cannot-find-the-server page, and a native app usually behaves the way it does with no network at all. Domains you have not blocked resolve normally, so nothing else changes.
Rules persist. They survive a restart of the Mac and blocking resumes automatically, so a rule you added once stays a rule until you remove it.
The Rule Applies to the Whole Mac
Domain rules are machine-wide by design: what a Pi-hole does for a whole network, they do for this Mac. A blocked name is blocked for every app and every browser, regardless of how each app's traffic is routed. There is no per-app version of a domain rule: SplitTunnel does not scope a name to one app, so blocked here and allowed there is not a combination it offers.
When the goal really is one app rather than one name, the app-level block in the Apps panel is the tool. It cuts that app off from the network entirely, which is a different shape of control on a different axis. Plenty of setups run both.
Where a Domain Rule Ends
- •
Software on encrypted DNS: a browser or app that sends lookups over DNS over HTTPS to its own provider bypasses DNS-layer blocking. Turn on Block Encrypted DNS in the Strict Mode section of Settings and it falls back to the system resolver, where rules apply. It is a curated list of resolvers, so software that pins its own resolver by IP address stays out of reach
- •
Connections made straight to an IP address: no name is looked up, so there is no name for a rule to act on
- •
Names already cached and connections already open: these can serve a domain for a little longer after you add a rule. Restart the app or browser to apply the block cleanly
The first of those is shared by every DNS-layer blocker, Pi-hole and AdGuard Home included. It is a property of the layer rather than a shortcoming of one tool, and knowing it up front is what keeps a rule from looking mysteriously broken.
Frequently Asked Questions
One Name, One Rule, Whole Machine
Add a domain rule and it covers every app on the Mac, subdomains included. No terminal, no config files, one click to reverse.
7-day free trial · Cancel anytime