I wanted the opposite: allowlist‑only browsing. Block everything by default, and explicitly allow only what I need.
So I built Sinkzone: a local DNS forwarder with two modes:
Monitor mode: lets all traffic through, but logs every domain so you can decide what to allow.
Focus mode: only allowlisted domains resolve; everything else is blocked (NXDOMAIN).
It’s open source, written in Go, and runs locally on macOS, Linux, and Windows. Works a bit like Pi‑hole, but instead of blocking ads, it blocks everything unless you say otherwise.
I’m curious if this would be useful in your workflow. If you try it, please let me know what breaks, what works well, and what you’d improve.
Currently, when I need to focus, I use a separate device configured to block everything except 2-3 domains I really need to minimize distractions. What really makes Sinkzone interesting is the scheduling with focus mode which can be incredible useful. My current firewall, OpenSnitch only lets you toggle all rules at once, so Sinkzone could be useful for allowing just the focus domains.
I think a useful feature to consider is having different profiles which would essentially be collections of domains to allow. So you could have "focus", but also "work" or "kids" as well allowing for more flexibility.
As I previously mentioned, I'm currently using OpenSnitch [1] as a system-level firewall that has a similar allowlist-only functionality. While the popups to allow/reject a connection initially disturb your workflow, after a short period of usage, you end up with a small collection of rules and you'll pretty much only see them again when browsing new websites. The advantage over DNS-level blocking is that you also get to block per process and not just device (or network). Since it uses eBPF, processes can't get around it by using a different DNS server or something. I'm really missing profiles and scheduling though, so I hope you can build a viable alternative to switch to!
Most of my ip blocking is by country or company. I have country, company-block, and company-allow lists in pf that are updated nightly.
I have found that once your dns list is sufficiently robust you rarely trigger an ip block. I have to add a new domain about once a month.
I will likely move on to Win10 now that it is ending support later this year so I might try there too. Windows support is best consumed in small chunks so once they deep-six Win10 it will be ready for consumption since the only "updates" it is likely to get are those strictly related to protecting it from malware.
Years ago there was a software firewall called SyGate that allowed a user to block everything and then set allow rules as they needed so that the only applications that could get out were those explicitly allowed by the user. The internet was young and there were fewer bad actors so it was way ahead of its time on the consumer side. You could install the free version or pay for a premium version. It was bought out in the late 90's I think by Norton or one of those other big units (Symantec?) who used all the good parts in their own "improved" firewalls, for a lot of money though.
I like this idea of blocking everything except the things you know you need.
Improvement idea: Integrate with Apple Shortcuts, so the user could automate switching focus mode on and off, tied to changing Apple Focus mode.
I really like the inversion of block to allow I think it makes sense.
In my use-case I would allow different lists for different profiles
(on the other hand I have blacklisted domains that I block regardless of using work / private / family profiles)
Happen more than I'm willing to admit, so I guess I will give a try
My suggestion: Allow by ASN would be a clean (simple) way to get all of Google, etc., allowed at once.
[1] https://github.com/proxylity/examples/tree/main/dns-filter
Your mileage might vary, but in my home, causing my smarthome plus my wife and children’s internet to go offline might cause a bigger distraction to my focus. Also you couldn’t use a pi-hole at work for instance.
- TUI based configuration
- API endpoints
