Limits
BLOKD is honest about what DNS blocking can and cannot do without root.
What DNS blocking cannot fix
- Server-side ad insertion (SSAI): ads served from the same host as video content
- Custom encrypted resolvers: an app using an obscure DoH/DoT endpoint that is not on the block list can still evade filtering. v1.2.0 blocks known providers and intercepts common hardcoded resolver IPs, but cannot catch every private one
- First-party ads: content served from the app's own domain
- Non-DNS connections: direct IP connections that never query blocked names
What v1.2.0 does not do
- Full-tunnel traffic interception (Berserk is aggressive blocklists only)
- Universal port 853 (DoT) or 784 (DoQ) blocking (only DNS aimed at well-known public resolver IPs is intercepted)
- Root-level hosts file or system-wide firewall rules
Full-tunnel Berserk is planned for a future release.
Research
See OTT streaming findings for a concrete example of SSAI limits in a major streaming app.