What DNS over HTTPS Actually Is

DNS over HTTPS, usually shortened to DoH, is a public internet standard, not a browser trick and not a proprietary feature. Ordinarily a program that wants to reach a site asks the system for the address behind a name, and the system resolver answers. With DoH, the program sends that lookup over an encrypted HTTPS connection to a resolver the software itself chose, and the answer comes back the same way. The system is never asked, and the network the Mac happens to be sitting on cannot read the question.

It is worth being fair about why it exists, because most of the writing on this subject is not. Plain name lookups were readable by anyone carrying the connection, which on cafe, airport, or hotel Wi-Fi means whoever runs that network. Those lookups could be logged, sold, or quietly answered with the wrong address to send you somewhere else. DoH closes that gap. Browser vendors adopted it because it protects people who have no way of judging whether the network they just joined is trustworthy, which is most people, most of the time.

Why It Walks Past DNS-Layer Blocking

The property that protects a lookup from the coffee shop protects it from you as well. DNS-layer blocking works because software on your Mac asks the system for a name, which gives you a place to decide what the answer is. Software that asks somewhere else never puts the question in front of you at all. The site loads, the rule looks broken, and nothing is actually wrong with the rule.

Be clear about who this affects: everyone. Pi-hole, AdGuard Home, a filtering resolver on your router, a cloud resolver your devices point at, and SplitTunnel all lose sight of a lookup that leaves over DoH, and all of them for exactly the same reason. This is a property of the DNS layer, not a defect in any one product. A blocker claiming immunity to it is describing something other than DNS-layer blocking.

There is also no simple way to tell such a lookup apart from browsing. By design, a DoH lookup travels as ordinary encrypted web traffic and is meant to be indistinguishable in kind from any other page a browser loads. That was a deliberate goal of the standard, and it works, which is exactly why the answer below is about resolvers rather than about spotting individual lookups.

What Strict Mode Does

SplitTunnel's answer is Strict Mode. Turn on Block Encrypted DNS in the Strict Mode section of Settings. Strict Mode blocks known encrypted-DNS (DoH) resolvers, so software falls back to the system resolver, where your rules apply. It works from a curated list of resolvers, not a promise about every one that exists: software that pins its own resolver by IP address stays out of reach.

In practice that covers the mainstream case, because the mainstream case is a browser reaching for one of a handful of well-known providers by default. Once it falls back, your domain rules apply to that browser the way they already applied to everything else on the machine.

The Two Questions People Arrive With

Almost everyone reading this got here through one of two doors, and they turn out to have the same answer.

The first is: my blocking stopped working and I think encrypted DNS is why. It usually is, particularly when a rule works everywhere on the Mac except in one browser. Turn on Block Encrypted DNS, restart that browser, and the rule starts applying there too. If you would rather solve it inside the browser instead, most browsers expose their own encrypted-DNS setting and you can simply switch it off there, one browser at a time.

The second is: I want to stop apps on this Mac from using DoH at all. This one deserves a straight answer rather than a comfortable one. There is no switch anywhere on macOS, in SplitTunnel or outside it, that guarantees no program will ever use encrypted DNS. What Strict Mode gives you is the practical version: the resolvers software actually reaches for stop being reachable, so it falls back to the system resolver, where your rules apply. That is a curated list doing well against normal software, not a wall.

The Limits, Stated Plainly

• •

  Curated, not exhaustive: Strict Mode works from a list of known resolvers, so a new or obscure one can be missed

• •

  Software that pins its own resolver by IP address stays out of reach, because nothing about it depends on a name you could block

• •

  Connections made straight to an IP address involve no name lookup at all, so there is no name for a domain rule to act on

• •

  Names already cached and connections already open can serve a domain for a little longer after any change. Restart the browser or app to apply it cleanly

None of that is a surprise once you know where the DNS layer starts and stops, and stating it up front is what keeps a working setup from looking mysteriously broken later. The first two items on that list are shared by every DNS-layer blocker in existence. The third is inherent to working on names at all.

What Strict Mode Does Not Change

It does not send your browsing anywhere new. Lookups are processed locally on your Mac and are not sent off to be classified, which is the part people reasonably want reassurance about when they are being asked to switch off a privacy feature. It also does not change your rules: what was blocked stays blocked, what was allowed keeps resolving normally, and a rule still covers subdomains beneath it automatically.

It is also not a one-way door. Block Encrypted DNS is a switch like any other, and turning it off puts you back exactly where you started.

When You Should Not Fight DoH

There is a real case for leaving encrypted DNS alone, and it is not a rare one. If you are on a network you do not control and have no reason to trust, hotel Wi-Fi, an airport lounge, a conference hall, a network in a place where lookups are monitored as a matter of course, then DoH is doing a job for you that nothing else on the machine is doing. Blocking those resolvers there hands your lookups back to whoever runs that network, which is a poor trade if you were not filtering anything in the first place.

The distinction that matters is whether you are the one doing the filtering. Strict Mode exists so that the rules applying on your machine are the rules you wrote. If you are not blocking anything and your actual worry is the network you are sitting on, DoH is on your side and there is nothing here to fix. Plenty of people run Strict Mode at home, where their own rules are the point, and switch it off while travelling. That is a sensible way to hold both ideas at once.

Where This Leaves Your Rules

With Strict Mode on, a domain rule does what it looked like it should do all along. Add a hostname under Domain Rules, or block one straight from the Activity panel when you have just watched an app reach somewhere unexpected, and the name stops resolving for the whole machine: every app, every browser, and every background helper, whatever route that app's traffic takes.

Encrypted DNS was the one thing standing between the rule and the browser. It is worth understanding rather than resenting, because on the wrong network it is the thing protecting you, and on your own machine it is simply in the way of a decision you already made.