How Blue Guard blocks content
The two mechanisms are independent. Each has its own switch in Blue Guard's Settings screen, under Protection, and each can be on while the other is off.
Safari blocking
Blue Guard compiles filter lists into a Safari content rule list and installs it. From then on Safari does the matching. Three kinds of rule go into the list:
- Block. The request is not made, so the resource is never downloaded.
- Hide. A page element matching a CSS selector is not displayed. It has limits, set out in Custom rules.
- Exception. Earlier rules are ignored for a given site. Your allowed sites are held as these.
Because Safari owns the matching, Blue Guard is never consulted as you browse and learns nothing about the pages you open. The same design means Safari reports nothing back, so Safari blocking contributes nothing to the counts on the home screen.
Safari caps how many rules a content blocker may hold. Blue Guard installs one list, so a change that would take it past the cap is refused rather than partly applied, and the app tells you the change did not reach Safari. The categories and an ordinary allowlist sit well inside the cap.
Choosing what to block
Under Filters in Settings, four categories can be switched on or off independently:
| Category | What it covers | Ships |
|---|---|---|
| Ads | Advertising and ad-serving networks | On |
| Trackers | Analytics, tracking and session-recording domains | On |
| Social widgets | Share buttons, embeds and social tracking pixels | On |
| Annoyances | Consent and cookie-banner platforms, newsletter and upsell overlays | Off |
Annoyances ships off because blocking a consent platform is not always an improvement. Usually the banner goes; on a site that gates its content behind consent, the page may show nothing at all instead. Turn it on and see.
Turning a category off removes its rules from the list Safari holds. The change takes effect on the next page load. A category with no rules in the current list is greyed out.
You can add your own rules alongside the categories. See Custom rules.
App-wide blocking
App-wide blocking filters the domain lookups your device makes. It runs through a packet tunnel network extension, which is why iOS asks to add a VPN configuration the first time you switch it on.
When it is running:
- A lookup for a domain on the block list is answered on the device. Nothing is sent anywhere.
- Every other lookup is forwarded so it can be answered, to Cloudflare (1.1.1.1) and Quad9 (9.9.9.9). Blue Guard alternates between the two and offers no others, so there is nothing to choose.
- Forwarded lookups travel over DNS over TLS on port 853. The connection is encrypted and the resolver's certificate is verified before any lookup is sent. There is no unencrypted fallback: if an encrypted connection cannot be established or verified, the lookup is not sent and resolution fails rather than being retried in the clear.
A resolver receives the domain looked up and the network address it came from. systemBlue does not receive, proxy, observe, log or retain any lookup or any answer, and operates no server that could. Each resolver is an independent controller under its own privacy policy.
Switching app-wide blocking off ends all of this. Safari blocking is unaffected either way.
What the domain filter can and cannot reach
Working on domain names is what lets one filter cover every app. It also sets the boundary:
- An advert served from an app's own domain cannot be blocked without blocking the app.
- Page elements cannot be hidden outside Safari, because hiding needs a CSS selector applied to a page and only Safari's content blocker can do that.
The same category switches apply here, and so do your allowed sites. Custom rules apply where they can be read as whole domains; see Custom rules for which forms carry across.
Counts on the home screen
The Home screen shows how many lookups were refused today, with a bar for each day of the past week, and the category control above the figure narrows it to All, Ads, Trackers, Social or Other. Two of those names are shortened for the control: Social is the Social widgets category, and Other is Annoyances.
These counts come from app-wide blocking alone, so with that switched off there is nothing to count. Each total is a number against a date, with no domain, address or page recorded beside it. Totals are kept for 30 days and none of them is transmitted.