The Gap You Notice on Day Two

The first move is usually an extension, and for a day it looks like it worked. Then the desktop client refreshes in the background, a notification arrives from the menu bar, a link opens in the other browser you keep for work, and the feed is back. Nothing broke. The block was simply never in the places the service actually lives.

• •

  A browser extension covers the browser it is installed in, and a second browser or a fresh profile walks straight past it

• •

  Desktop clients for the major platforms never involve a browser, so a browser-shaped block cannot see them

• •

  Background helpers keep checking for notifications while the app window is closed

• •

  Links open wherever the system sends them, which is not always the browser you locked down

One Layer Below the Apps

SplitTunnel handles your Mac's DNS lookups, so a rule applies at the DNS layer, below the individual apps and browsers. Add a hostname under Domain Rules and the name stops resolving for the whole machine: every app, every browser, every background helper, no matter whether that app's traffic goes out through a VPN or straight over your normal connection.

The practical consequence is that you stop maintaining a per-app checklist. One entry covers Safari, Chrome, and Firefox at the same time as the desktop client, the menu bar helper, and whatever opens when you click a link in a document. It also covers the browser you install next year and the profile you have not created yet, because the rule belongs to the machine rather than to a browser.

Blocking the Domain Blocks the App. That Is the Point

Be deliberate here, because it surprises people who expected a browsing-only block. The desktop client reaches the same names as the website. Once the name stops resolving, the client stops working: it sits on a spinner, shows whatever offline state it has, or fails to sign in. For someone trying to get a service out of their working day, that is the outcome they wanted and the reason the rule was worth writing.

What SplitTunnel does not offer is the split version of that. Domain rules are machine-wide, and a name cannot be scoped to one app, so blocked in the browser but allowed in the desktop client is not a combination available in this version. Per-app control works on a different axis: an app-level block in the Apps panel cuts one app off the network entirely, whatever names it wanted to reach.

So if you need the service in one place for work and gone everywhere else, the honest answer is that a domain rule is the wrong shape. Block the app you do not want, and leave the domain alone.

Add the Rules

Subdomains Are Included. Sibling Domains Are Not

A rule on a hostname also covers anything underneath it, so the mobile host, the media host, and the app-specific host all come along without being listed anywhere. That accounts for most of what a platform uses day to day.

Sibling domains are the part that needs attention. Big platforms usually own a short-link domain for shared links and often a separate name for images and video, and those are separate domains that need their own rules. The reliable way to find them is not a list from a forum post: open Activity, use the app for a minute, and read the domains your own Mac looked up.

The Honest Limits

• •

  Software on encrypted DNS: a browser or app that sends lookups over DNS over HTTPS to its own provider bypasses DNS-layer blocking. Turn on Block Encrypted DNS in the Strict Mode section of Settings and it falls back to the system resolver, where your rules apply. It is a curated list of resolvers, so software that pins its own resolver by IP address stays out of reach

• •

  Cached names and open connections: after you add a rule, restart the browser or client so the block applies cleanly rather than a few minutes later

• •

  This is not a lockout. Every rule has an Unblock next to it, and nothing stops you clicking it. If you need something a future you cannot reverse, a commitment tool with scheduled lockouts is the honest recommendation

• •

  The Mac only. Blocking that runs here covers this machine, not the phone in your pocket, which is usually the other half of a social media habit

• •

  Machine-wide cuts both ways: the rule applies to every account on the Mac, so on a shared machine a shared rule is what you get

What Actually Changes

Expect coverage, not transformation. The reflex survives the rule: you will still reach for the shortcut, and the client will still sit in the Dock waiting to be clicked. What changes is that the reach ends there, in every app rather than in one browser, and that you stop rebuilding the block every time you install something new.

That is a smaller claim than most focus software makes, and it is the accurate one. A domain rule is a standing decision about what this machine can reach, applied everywhere on it at once, holding through reboots until you decide otherwise.