Three Ways You Got Here

A tracking domain usually arrives from one of three places. You watched an app in the Activity panel and one name kept coming back. Your browser's privacy report listed something it had stopped. Or an article named a specific endpoint and you would like it gone from your own Mac. Whichever it was, the work is the same: confirm, block, and check that nothing you cared about left with it.

Confirm It Before You Block It

This is the step people skip, and it is the one that saves an afternoon. A name from an article may not be contacted by anything you run. A name from a privacy report may be arriving through an app you never suspected. The Activity panel shows which app looked up which domain and where its connections are going, which turns something you read into something you can see on your own machine.

Block It

Two routes, both real, both ending in the same list.

A blocked name stops resolving for the whole Mac. Every app and every browser is covered, whatever route that app's traffic takes, so there is no version of this you have to repeat per browser or per program.

One Rule, Everything Beneath It

You do not have to enumerate hosts. A rule on a hostname also covers anything underneath it, so blocking a tracker's domain takes the regional and numbered variants beneath it as well, including ones that did not exist when you wrote the rule. That is most of why a domain rule beats a hand-maintained list of names.

The Shortcut for Trackers at Volume

Blocking trackers one at a time is satisfying and it does not scale. Most of the volume is already handled: open Settings and turn on Block Ads and Trackers. Ads and trackers ship as one list, so that single switch covers both, and Block Malware and Scams sits beside it as the second. The lists come from the HaGeZi project and are refreshed daily.

Two honest notes about how the curated side behaves. Not every domain the lists catch appears as its own row in Activity in this version, so the switch is doing more than the panel itemizes for you. And the lists do not take per-domain exceptions: they apply to every app, and individual domains cannot be excluded from them in this version. Your own rules are the part you see and control one at a time.

In practice the two halves settle into a division of labor. The curated lists handle the known tracking industry quietly in the background, and your short list of rules handles the specific things you watched your own machine do.

If the Domain Still Loads

• •

  Restart the app or browser: connections that are already open and names already cached can keep a domain reachable for a little longer after you add a rule. A restart applies the block cleanly

• •

  Check the spelling in Domain Rules: a rule on a name that does not exist blocks nothing, and it is the most common reason a rule looks broken

• •

  Encrypted DNS: a browser sending its lookups to its own encrypted-DNS provider goes around the system resolver. Turn on Block Encrypted DNS in the Strict Mode section of Settings, then restart the browser. It works from a curated list of resolvers, so software that pins its own by IP address stays out of reach

• •

  Connections made straight to an IP address: no name is looked up, so there is no name for a rule to act on

The encrypted-DNS ceiling belongs to the DNS layer itself rather than to any one product. Pi-hole, AdGuard Home, and a filtering resolver on a router share it for the same reason, which is worth knowing before you conclude a rule failed.

Keep It Small

None of this needs to become a project. Turn the curated list on, spend ten minutes watching an app you were curious about, block the two or three names you feel confident about, and stop. If something you needed breaks, open Domain Rules and click Unblock. The value is not a long rule list. It is that the traffic leaving your Mac is now something you have looked at rather than something you assume.