Why Block · Settings
Key security
DNS filtering
Set up whichever DNS filters you use. You can enable more than one, e.g. Pi-hole forwarding to Control-D or NextDNS. Why Block asks each enabled filter whether it blocks a failing domain, shows which rule or list did it, and can add an allow rule. Passwords and keys stay in this browser’s extension storage (encrypted if you turn on Key security above) and are sent only to that provider.
Options for all DNS filters
Used to tell a block apart from a domain that doesn’t exist. Default is Control-D’s own unfiltered resolver (p0); any RFC 8484 resolver works, e.g. https://cloudflare-dns.com/dns-query.
Control-D
Create a token in the API section of the Control-D dashboard. A Read token is enough to detect and explain blocks; a Write token is needed for the “Allow” button. The token is stored only in this browser’s extension storage (encrypted if Key security is on) and is sent only to api.controld.com. Least privilege: use a Read token unless you want Allow, and restrict it to your IP addresses in the Control-D dashboard.
The macOS app is linked to one device; picking it fills in the resolver and the profile it enforces.
Domain intelligence
The shield button next to a domain opens its safety, security and privacy dashboard. A check runs only when you open it, and it sends the domain name (never the full URL) to the sources switched on below. All keys are free for personal use and stay in this browser’s extension storage.
Individual blocklists
Downloaded lists are searched inside the browser, so checking them sends no domain name anywhere. Large lists are downloaded the first time you open a dashboard after they expire.
Your own lists
Add blocklists you trust. They appear as “Your own lists” on the domain dashboard. Accepted formats: one domain per line, hosts files (0.0.0.0 example.com), adblock rules (||example.com^), URL feeds, or a CSV with URLs or domains in any column. A domain counts as listed when it or one of its parent domains is on the list. Lists are checked inside the browser; nothing is sent anywhere except the download itself.
Add a list
Back up & restore
Save your whole Why Block setup (settings, DNS filters, data sources, your own lists and, if you like, your API keys) to one file protected by a password. Use it to move to another browser or computer, or to keep a copy. Passkeys can’t be moved; after restoring, add one again under Key security.
Export
There’s no way to open the file without this password. Keep it somewhere safe.
Restore
About Why Block
Designed for the privacy/security conscious user. This tool will help to assess what functionality may be limited, and which privacy/security controls may be causing a site to not function properly. Designed to work with: Brave Shields, Firefox Tracking Protection, NoScript, uBlock Origin, Privacy Badger, and DNS providers including: AdGuard, Control-D, NextDNS, and Pi-hole.
Why Block is provided as is, without warranty of any kind; use it at your own risk. Its diagnoses and safety verdicts are guidance, not guarantees. Terms of use · Privacy policy ·
About the checks
- DNS-filter checks send the failing domain name to the DNS providers you’ve set up, and to the unfiltered comparison resolver.
- When an explanation is requested for Control-D, the filters enabled in your profile are tested one by one against Control-D’s public single-filter resolvers (freedns.controld.com).
- The domain dashboard sends the domain name (never the full URL) to the sources switched on above. Downloaded blocklists and your own lists are searched inside the browser.
- Nothing else leaves the browser. Request logs are kept in memory/session storage and cleared when the tab closes.