What Screen Time Is Actually For

Screen Time is built to manage time and habits for a person. App limits, downtime windows, schedules, and a weekly report on where the hours went are all genuinely useful, it is right there in System Settings, and for families sharing devices it does the job it was designed to do. This guide is not an argument against it.

It is for the specific moment when you tried it, found it did not hold, and realized the thing you wanted was not a usage limit at all. You wanted a site your Mac does not reach.

Where Screen Time Stops

None of the following is a defect. They are the boundaries of a usage-management tool, and they only become frustrating when you were quietly hoping for a network tool instead.

• •

  It belongs to a user account, not to the machine. Settings are configured per account, so another account on the same Mac carries its own

• •

  It is organized around an Apple Account. Syncing across devices and family setup hang off account identity rather than the Mac sitting in front of you

• •

  The passcode is the entire lock. Anyone who knows it can lift a restriction in a few clicks, and that includes you at eleven at night

• •

  It is aimed at web browsing rather than at everything an app does on the network. There is no way to point it at a maintained blocklist you did not build yourself

• •

  It reports time, not destinations. It can tell you how long an app was open. It cannot tell you which domains that app contacted while you were doing something else

Read that list back and the pattern is clear. Screen Time answers questions about a person and their hours. The question you are asking is about a machine and what it can reach, and those are different questions that want different tools.

A Rule at the Network Level Instead

SplitTunnel handles your Mac's DNS lookups, so a rule applies at the DNS layer, below the individual apps and browsers. Add a hostname under Domain Rules and the name stops resolving for the whole machine: every app, every browser, every background helper, no matter whether that app's traffic goes out through a VPN or straight over your normal connection.

The practical difference is coverage. One rule, written once, applies to the browser you have not installed yet, to the desktop app version of the same service, and to every account on the Mac. Nothing has to be repeated per browser and nothing quietly stops applying because you signed in somewhere else.

Add the Rule

What You See When It Works

The domain stops resolving. The lookup fails, so the browser never learns the address to connect to and shows its ordinary cannot-find-the-server page. There is no countdown, no lecture screen, and no button offering you fifteen more minutes. For a lot of people that plainness is the appeal: there is nothing to argue with.

You also do not have to enumerate variants of the name. A rule on a hostname also covers anything underneath it, so the mobile host, the CDN host, and whatever host gets added later are all included. Separate domains are still separate rules, and large services often own several, so it is worth checking Activity after you add the first one.

Rules persist. They survive a restart of the Mac and blocking resumes automatically, which is the one behavior people most often assumed they were getting from Screen Time in the first place.

The Honest Limits

• •

  Browsers on encrypted DNS: Chrome and Firefox can send lookups over DNS over HTTPS to their own provider and bypass DNS-layer blocking. Turn on Block Encrypted DNS in the Strict Mode section of Settings and they fall back to the system resolver. It is a curated list of resolvers, so software that pins its own resolver by IP address stays out of reach

• •

  Cached names and open connections: after you add a rule or switch on Strict Mode, restart the browser so the block applies cleanly

• •

  This is not a lockout. Every rule has an Unblock next to it, and nothing stops you clicking it. If your requirement is that a future you cannot undo the decision, a commitment tool with scheduled lockouts is the honest recommendation

• •

  Machine-wide cuts both ways: a rule applies to everyone using the Mac. On a shared machine, a shared rule is what you get

That third point is the one worth sitting with. Screen Time can be lifted with a passcode, and a domain rule can be lifted with a click. Neither is willpower in software. What a domain rule changes is how wide the block reaches and how little maintenance it needs, not how hard it is to reverse.

Using Both

These are not rivals, and treating them as an either-or is how people end up with neither. Screen Time is still the better answer for the time-shaped part of the problem: downtime in the evening, app limits, the report on Sunday that tells you something you did not want to know.

A domain rule handles the reach-shaped part: this name should not resolve on this machine, in any browser, in any app, for any account. Most people who search for a way around Screen Time actually wanted both halves, and running them together is entirely reasonable.