The decision order
- Ignored DNS record types bypass their own questions.
- Global pause permits filtering bypass.
- Any matching, scheduled whitelist target bypasses filtering.
- An exact client-IP endpoint takes priority.
- Next comes an exact or most-specific wildcard PTR hostname.
- Then the most-specific matching network.
- Otherwise, the unmatched-client fallback applies.
One winning target
The highest-priority matching target whose schedule is active supplies scoped lists and pause behavior. Lower-priority targets do not add their lists. A hostname target with no assignments does not inherit the network’s block lists. Applicable global lists still participate.
Whitelists win
Active domain whitelists are evaluated before block lists. A matching whitelist permits the domain even if a block list also contains it. A whitelist target bypasses filtering for its matching clients regardless of whether another target is more specific.
Unmatched clients
Under System Settings → DNS & logs, choose whether global lists reach all clients or only matched targets. Default action can Allow or Deny otherwise-unmatched queries. Eligible global lists are evaluated before that fallback.
Test before applying broadly
Use Policy Tester to inspect a client IP, domain, record type, and optional time. It explains the winning target, applicable lists, schedules, and learned PTR identity without sending a DNS query or creating log rows.