What NextDNS Is

NextDNS is a filtering resolver that runs in the cloud. You point a device, or a whole router, at their service, choose what you want filtered in a web console, and lookups are answered and classified on their end. The configuration belongs to your profile rather than to any one machine, so a laptop, a phone, and a tablet set up the same way behave the same way.

That is a genuinely good design, and it is why a cloud resolver is the usual recommendation for anyone with more than one device to cover. It also defines exactly what a local alternative changes and what it gives up.

Why People Look for a Local Alternative

• •

  Lookups leaving the device: with any resolver in the cloud, your queries are answered by a service that is not yours

• •

  A dependency you do not control: the resolver becomes part of your path to the internet

• •

  One device is the real scope: you want your Mac filtered and have no use for a profile on five devices

• •

  You want app-level control too, not only domain-level filtering

When NextDNS Is the Better Choice

None of the following is faint praise. If your answer to "what needs filtering" is "all of my devices," a cloud resolver is the shorter path and a Mac app is not going to get you there.

• •

  You want the same blocking on many devices, including iPhones, iPads, and Android phones, where a Mac app cannot help at all

• •

  You want your configuration to follow you between networks without touching each device again

• •

  You want a hosted query log and per-domain allowlists you can adjust from a browser anywhere. SplitTunnel's curated lists are on or off, and individual domains can't be excluded in this version

• •

  You are setting up filtering for a household or a small team and want one configuration to maintain rather than one per machine

What Changes When the Filtering Is Local

SplitTunnel does the same DNS-layer job in a different place. Lookups are processed locally on your Mac, and a domain on a curated list or in your own rules stops resolving, so the connection is never made.

• •

  No cloud DNS dependency: your queries are not sent anywhere to be classified

• •

  Curated lists from the HaGeZi project, refreshed daily, behind two switches: Block Ads and Trackers, and Block Malware and Scams

• •

  Your own rules alongside them, and a rule on a hostname also covers anything underneath it

• •

  Rules apply to every app and every browser on the Mac, whether that app's traffic is routed through a VPN or connects directly

• •

  Settings survive a reboot, and blocking resumes on its own

The Part a Resolver Does Not Attempt

The bigger difference is not where the filtering happens, it is what the tool can act on. A filtering resolver sees names. It has no notion of which app on your Mac asked for one, and no way to treat two apps differently.

SplitTunnel is a per-app network tool that includes DNS-layer blocking. The Activity panel shows which app looked up which domain and where its connections are going, so you can block what you actually saw instead of guessing from a list. The Apps panel is where per-app control lives: choosing which apps use the VPN and which connect directly, or cutting one app off from the network entirely.

Those are deliberately separate tools. Domain rules are machine-wide, so there is no "block this domain, but only in that app." The per-app side is the app-level block and per-app routing. Most setups end up using both.

A concrete version of the difference: an app you keep installed but rarely open is quietly contacting a handful of endpoints all day. A resolver can block those names for everything on the network, which is fine when the names carry nothing you want. When they are shared with software you do use, the name-level answer runs out, and the question becomes which app should have the network at all. That is a per-app decision, and it needs a tool that runs on the machine the app is running on.

What You Give Up Going Local

The honest inventory, because a comparison that only lists strengths is not useful to anyone choosing.

• •

  One machine: blocking covers the Mac it runs on. Your phone, your tablet, and everything else on the Wi-Fi are untouched

• •

  No hosted history: there is no account holding a searchable log you can open from another device

• •

  No per-domain exceptions on the curated lists: they are on or off, and individual domains can't be excluded in this version

• •

  Nothing to share: a household or a team configures each Mac rather than one profile for everyone

If more than one of those is a problem for you, the cloud resolver is the better answer and this guide has done its job by telling you so.

Set It Up

There is no profile to create, no address to paste into your network settings, and nothing to reconfigure when you join a different Wi-Fi network. The blocking is running as soon as the switches are on.

The Ceiling Both Share

A browser or app configured to use its own encrypted-DNS (DoH) provider bypasses whatever resolver the system is set to use. That is the same whether the resolver is NextDNS, a Pi-hole down the hall, or SplitTunnel on the Mac. The lookup never reaches the filter, so the filter cannot block it.

The fix has the same shape everywhere, which is getting that software back onto the resolver you chose. In SplitTunnel that is Strict Mode: turn on Block Encrypted DNS in Settings and Strict Mode blocks known encrypted-DNS resolvers, so software falls back to the system resolver where your rules apply. It works from a curated list of resolvers, so software hard-wired to one encrypted resolver remains out of reach.

Which to Pick

• •

  Many devices, phones included, one configuration to maintain: NextDNS

• •

  One Mac, lookups processed locally, nothing in the path you do not run yourself: SplitTunnel

• •

  Domain blocking plus per-app routing and per-app blocking in one place: SplitTunnel

• •

  Both, if the household needs coverage and your Mac needs app-level control. They do not conflict

The honest summary is that these tools answer different questions. A cloud resolver answers "how do I filter everything I own." A Mac app answers "how do I see and control what this machine does on the network." Pick the question you actually have.