Why Per-Browser Blocking Keeps Leaking

Most people arrive at this question the same way. You installed a site blocker in Chrome, it worked, and then you found yourself on the same site in Safari ten minutes later without really deciding to. The extension was not broken. It was just installed in one place, and browsers are not one place.

• •

  A second browser: the extension you set up in Chrome does nothing in Safari, Firefox, Arc, or Edge

• •

  A second profile or a private window: extensions are scoped per profile, and a fresh profile starts with none of them

• •

  Things that are browsers without announcing it: Electron apps, in-app web views, and help windows that open a page inside the app

• •

  Everything that is not a browser at all: desktop clients, updaters, and background helpers reach the same domains with no browser involved

• •

  Upkeep: every browser is a separate install, a separate settings screen, and a separate thing to redo after you reinstall it

Any one of those on its own is a small hole. Together they are the reason per-browser blocking feels like it half works.

One Layer Below the Browsers

The fix is to stop treating this as a browser problem. SplitTunnel handles your Mac's DNS lookups, so the block applies at the DNS layer, below the individual browsers. You are not adding a rule to Chrome and then adding it again to Safari. You are adding it once, in one place, for the machine.

Add a hostname under Domain Rules and the name stops resolving for the whole machine: every app, every browser, and every background helper, whether that app's traffic goes out through a VPN or straight over your normal connection. A browser you install next month is covered by the rule you wrote today, without you doing anything about it.

Add the Rule Once

You do not have to list the variants. A rule on a hostname also covers anything underneath it, so a rule on example.com takes www.example.com, m.example.com, and the CDN host beneath it at the same time. What it does not do is guess at separate domains: large sites often own several unrelated names, and each of those is its own rule.

What Each Browser Does When the Name Is Gone

The lookup fails, so the browser never learns the address to connect to. Each browser words its error page differently, but they all land in the same place: it cannot find the server. There is no block page, no branded interstitial, and nothing to click through, which also means there is nothing that invites a negotiation with yourself.

Native apps behave the way they do when the network is unavailable. Domains you have not blocked keep resolving exactly as before, so nothing else about your browsing changes.

The One Real Exception: Encrypted DNS

Chrome and Firefox can both send their lookups over encrypted DNS, known as DNS over HTTPS, to a provider the browser picked rather than asking the system resolver. When that setting is on, the lookup bypasses DNS-layer blocking altogether, and the site loads as though no rule existed. This is the single most common reason a rule looks like it did not work.

The fix is in Settings, in the Strict Mode section: turn on Block Encrypted DNS. That blocks known encrypted-DNS (DoH) resolvers, so a browser that reached for one falls back to the system resolver, where your rules apply again. It works from a curated list of resolvers rather than a promise about every one in existence: software that pins its own resolver by IP address stays out of reach.

That ceiling comes with the DNS layer itself, not with SplitTunnel. Pi-hole, AdGuard Home, and a filtering resolver on your router share the same blind spot for the same reason, which is worth knowing before you compare tools.

Non-Browser Apps Are Covered Too

This is the part a browser extension structurally cannot do. Because the block is not attached to a browser, a desktop client, an updater, a menu bar app, and a command line tool are all covered by the same rule with no extra setup. If the site you are blocking also ships a desktop app, one rule handles both.

It is also the reason to pick the name deliberately. Because the rule is machine-wide, a domain that some app quietly depends on goes away for that app as well. Block the specific hostname you meant, and if something you needed breaks, open Domain Rules and click Unblock.

If You Want It Blocked in Only One Browser

Then a domain rule is the wrong instrument, and it is better to say so plainly. Rules apply to the whole Mac, so there is no version of them that means blocked in Chrome and allowed in Safari. A browser extension is genuinely the right tool for that requirement.

The nearest thing SplitTunnel offers is the other axis: the app-level block in the Apps panel cuts one app off from the network entirely, rather than blocking one name everywhere. Most people asking this question want the machine-wide rule, discover the browser exception, turn on Strict Mode, and stop thinking about it.