KestrelNormal
default345,000
domains on the lists
Ads, trackers, telemetry, crash reporters and known malware. This level rarely gets in the way.
- HaGeZi Multi Pro · GPL-3.0
- HaGeZi Threat Intelligence mini · GPL-3.0
Kestrel blocks data collectors for every program.
Trackers, advertising and vendor telemetry no longer reach their servers. Kestrel blocks them quietly, without asking, and shows you every attempt.
What Kestrel blocks
Kestrel checks every name a program wants to reach against lists of known data collectors. If the name is on a list, the program is told that it does not exist, and no data flows.
- Trackers and ad networks in programs and websites
- Vendor telemetry, for example from Apple and Microsoft
- Crash reporters such as Sentry, Crashlytics and Firebase
- Known addresses of malware, phishing and fraud
What is never blocked
Names the system needs always get through, whatever a list says: certificate checks, updates, time, the detection of Wi-Fi sign-in pages, the basic functions of iCloud and notifications. A few names that only collect data stay blockable on purpose, such as metrics.icloud.com.
Three levels
You choose the level in the app, in the settings or in the menu bar. Kestrel only loads the lists of the chosen level.
Strict
357,000
domains on the lists
Also more vendor telemetry, above all from Apple and Microsoft. Now and then something may stop working.
- HaGeZi Multi Pro++ · GPL-3.0
- HaGeZi Threat Intelligence mini · GPL-3.0
- HaGeZi Native Tracker Apple · GPL-3.0
- HaGeZi Native Tracker Microsoft · GPL-3.0
Hardcore
786,000
domains on the lists
Blocks almost every data collector. Signing in with Facebook and Xbox achievements may stop working.
- HaGeZi Multi Ultimate · GPL-3.0
- HaGeZi Threat Intelligence medium · GPL-3.0
All lists come from HaGeZi and are licensed under the GPL-3.0. Kestrel does not ship them itself; it loads them straight from the source, at most once a day. If that fails, the last good copy stays in use and the app shows the error at the list.
With Pro you add your own lists, by their address or from the FilterLists.com directory, each with its licence. They apply on top of the level.
When something stops working
Doesn’t work any more?
If a program stops working after a block, “Doesn’t work any more?” shows what Kestrel blocked for that program in the last few minutes and which list is behind it. You allow a single destination with one click. If that is not enough, a pause lets everything through for five minutes.
Encrypted DNS
Programs that look up names themselves over an encrypted channel, such as a browser with secure DNS, bypass the DNS filter. Kestrel blocks no data collectors for them and shows only the address and operator instead of the names. Turn the setting off in the program so the protection applies there too. The filter itself can send its own lookups encrypted to Quad9 or Cloudflare.