Block it at DNS and you block it everywhere

Block it at DNS and you block it everywhere

There is a difference between blocking something in one browser and blocking it at the network level, and most people only discover it after they have tried the first one.

Ad blockers, extension filters, hosts files, a router setting. Each of these works, and each of them stops working the moment the thing moves to a different device.

The reason is structural. Every address lookup starts somewhere, and if you intervene at that one point, everything after it inherits the decision.

The single choke point

When a browser asks for a page, it does not know the address. It asks a resolver, which answers with an address, and only then does the connection happen.

That is the whole trick. The lookup is the one moment where a decision gets made, and every device on the network has to go through it.

So a resolver that answers differently for the domains you want gone changes the outcome everywhere at once: the phone, the tablet, the smart TV, the game console, the laptop in the other room. Nothing needs an extension, nothing needs a config file, and the person who set it up does not have to be the person using the device.

What a good resolver actually does

Saying no to a domain is the easy part. The interesting part is what happens to everything else.

A resolver that only blocks ads is a resolver you will turn off within a month, because the moment it breaks a login flow or a video call, the answer is to remove it. A useful one handles the categories separately: advertising and tracking get dropped, known malicious domains get dropped, and everything else resolves normally and quickly.

The distinction between "blocked because I asked" and "blocked because it is dangerous" is not cosmetic. It is the difference between a setting you keep and a setting you remove.

disable.page documents that layering, with the guides split by DNS, security and tooling instead of one long page nobody reads. It is at disable.page, and the site is at https://disable.page.

The permanent list

There is a second design decision that matters more than it sounds.

Some lists are meant to be edited. You add a domain, it gets blocked, you change your mind a month later, you remove it. The list is a to-do item.

Some lists are meant to be permanent. You add a domain, it stays blocked, and the list is a record of a decision you already made. That is a different artefact: it does not need maintenance, it does not need a review, and it does not need a policy about when to change your mind.

LockFilter is built that way, with a public URL per list that your resolver can load. It is at LockFilter, and the site is at https://lockfilter.com.

The reason this matters is that a permanent list is shared. One person decides that a domain is a tracker, publishes the list, and everyone else inherits the decision without having to make it.

What I would actually set up

If I were doing this on a network today, in this order.

1. Put the resolver on the router, not on the laptops. The router is the only device every other device has to go through.
2. Start with the tracking and advertising categories, not with the whole list. A resolver that is obviously too aggressive gets removed; one that is obviously right gets kept.
3. Keep the blocklist somewhere you can read it. A list you cannot inspect is a list you cannot argue with when something breaks.
4. Decide in advance which categories you will keep permanent and which you will treat as temporary, and write that decision down.

None of that is complicated. It is just easier to do it once, at the right layer, than to keep fixing it per device.