About blocklists

A blocklist is a list of servers that are known to be used for things like tracking, advertising, malware, or gambling. With a blocklist, you can block connections to all of these servers at once, without having to know any of them. Ad blockers in web browsers use similar lists, but they work only inside the browser. Little Snitch blocks these connections system-wide, for every app and process on your Mac.

Many blocklists are publicly available on the internet, usually one list per topic. People and organizations who care about privacy and security maintain them and update them as new servers appear.

Little Snitch reads most of the blocklist formats that you find on the internet. It downloads the lists, adds them to your rules, and keeps them up to date from their sources.

Preconfigured blocklists

To help you get started, the blocklist picker of Little Snitch offers a selection of blocklists for different topics. To open it, see Add blocklists.

The blocklists in the picker are maintained by third parties, and Objective Development has no affiliation with them. For more information about a blocklist, visit the website of its publisher. We chose the lists by these criteria:

Somebody still maintains the list, and it was updated recently.
The list is at least one year old.
The list gets frequent updates.
The maintainer of the list removes outdated entries.
There seems to be a community that supports and uses the list.
The list is relevant for macOS, not only for Windows malware.
Each category has only a few lists.

Choose a set of blocklists

Which lists are right for you depends on what you want to block, so we don’t recommend specific lists. These guidelines help you choose:

Don’t add more lists than you need. A blocklist may contain “false positives”: servers that the list blocks, but that you don’t want to block. Each list you add makes this more likely. For example, a list against trackers might block t.co, the URL shortener of X. That’s consistent with the purpose of the list, but if you use X, links in posts stop working, and you’ll want to disable this entry.
Decide which categories you want to block. Block gambling or explicit content only if you need to protect yourself or members of your family from it. Don’t block ads if you, or someone in your family, like to follow the shopping recommendations of Google.
Look at the blocklists in these categories, and choose one or a few per category, based on the information that matters to you.
After a while, check how much each list is used. If a list for trackers or ads has a low use count, you can remove it. Don’t judge a malware list by its use count, though: ideally, it stays at zero. If it protects you from an infection just once in your life, it was worth it.

Supported formats

Little Snitch supports the following formats:

hosts: If the downloaded file looks like an /etc/hosts file, Little Snitch uses it as a blocklist of hostnames.
domains: If the file contains hostnames, separated by anything such as new lines or commas, Little Snitch uses them as a blocklist of domains. It blocks these domains and all hostnames in them.
IP addresses: If the list contains ranges of IP addresses, Little Snitch uses it as a blocklist of IP addresses. A range can be written as 1.0.0.0-1.255.255.255 or as 1.0.0.0/8 (CIDR notation).
.lsrules: This format holds any kind of rule group. If an .lsrules file “looks like a blocklist”, Little Snitch shows it in the Blocklists section. That’s the case if it contains only entries that deny hostnames, domains, or IP addresses for any process. If a blocklist is available in more than one format, prefer one of the other formats, because they’re more compact.