DNS filtering

The query path

NetScope checks an incoming DNS query on the device. A blocking match for a domain or its parent produces NXDOMAIN, a domain-not-found response. An allowed query is sent to Cloudflare using DNS-over-HTTPS. Checking is local; name resolution is not entirely local.

Rules and exceptions

The AdAway list has a bundled copy, with updates triggered in settings. If an update fails, the previous rules stay active. A bundled rules fallback is unrelated to a Direct transport fallback after a proxy failure.

Add a domain exception from its details in activity history. The exception applies to the specified domain name. Check the actual name in the event rather than broadening exceptions unnecessarily. An app’s block-all-DNS policy takes precedence over an allowlist entry.

Limits

DNS filtering does not read HTTPS page content or cosmetically hide elements. Ads sharing a domain with useful content can remain. Blocking all YouTube ads is not claimed.

An app’s own DoH, direct IP access and cached responses can avoid generating a DNS query visible to NetScope. See DNS troubleshooting.