One tap inside an app can trigger DNS lookups from the app, iOS, analytics, advertising, a content-delivery network, and another app waking in the background. The useful skill is not collecting every hostname. It is separating repeatable signal from infrastructure you should leave alone.
What Observation actually sees.
LetMeBe Observation Mode captures live DNS lookups on-device. It shows requested names, answer information, timing, and how often a candidate appeared. It does not read messages, page text, images, passwords, or the payload of a connection.
A hostname appearing during your test is correlation, not proof of exclusive ownership. iOS and background apps can generate traffic at the same time. That is why the workflow is deliberately repeatable.
Observation answers “what names appeared during this window?” It does not claim “this one process owns every name in the list.”
Prepare one clean experiment.
Decide on a single target action before starting. Good tests are specific: refresh a timeline, send one test message, open one video, or load one profile. “Use the app for a while” produces a noisy list and weak conclusions.
- Close unrelated apps you do not need. This reduces, but does not eliminate, background DNS activity.
- Choose one target action. Use an action whose network result you can recognize immediately.
- Record the starting state. Know whether the content is fresh, cached, signed in, or already loaded.
- Plan to repeat it. A useful candidate should appear across more than one comparable run.
Capture the action.
- In LetMeBe, open Custom Rules → Discover Domains.
- Tap Start Observing and wait until the status is Live.
- Switch to the target app and perform only the action you planned.
- Use the app for roughly 30–60 seconds, then return to LetMeBe.
- Stop observing when you have the result. The session stops automatically after five minutes if you do not stop it first.
If Blocking was on, LetMeBe pauses it while Observation captures DNS activity and restores the previous blocking intent after Observation ends. The status text in the app is the authority; do not assume capture is live while it says Waiting.
Read the rows before adding anything.
Candidate hostname
This is the normalized name LetMeBe can turn into a host rule. Review the whole hostname; a familiar brand fragment does not prove that the domain is safe to block.
Request count
Repetition can make a candidate more interesting, but a high count is not proof of importance. Telemetry and shared CDNs can be noisy too.
Latest answer and timing
The answer helps you see that the name resolved and whether the destination changed. It is diagnostic context, not a recommendation to block the returned IP.
Shared CDN warning
A shared content-delivery host can serve many unrelated apps. Blocking it may create collateral damage. LetMeBe flags known shared infrastructure so you can reject the tempting broad rule.
System-domain lock
Protected system domains stay disabled on purpose. They can be necessary for iOS, Apple services, notifications, time, certificates, or network health.
Choose the smallest useful set.
A strong candidate has three properties: it appears when the target action runs, appears again when you repeat that action, and disappears—or becomes much less active—when you stop performing it.
- Add one app-specific hostname, not every row.
- Leave shared CDN and system candidates alone.
- Enable Host Rules after at least one valid rule is saved.
- Turn Blocking on and reopen the target app.
- Repeat the exact action that generated the hostname.
Never paste a full URL into a host rule. Use only the hostname—for example,
api.example.com, without https://, a path, query,
username, or password.
Retest unrelated apps—and know the exit.
After the target action fails, test at least one unrelated app and an Apple service you rely on. Success means selective blocking, not merely breaking the network broadly.
If another app breaks, disable Host Rules or delete the newest hostname first. Reopen the affected apps and let them perform fresh lookups. Do not compensate for one overbroad rule by piling on more rules.
Understand the data boundary.
Observation begins on-device and does not inspect content payloads. To improve catalog accuracy, LetMeBe can submit limited DNS observation evidence—such as a domain, answer address, record type, time, and match context—to its Cloudflare-hosted API. The API pseudonymizes the device identifier before observation evidence is stored in the catalog database, and raw observation evidence has limited retention.
Read the DNS intelligence section of the Privacy Policy for the current fields, purposes, recipients, and retention periods. A technical guide should never replace the actual notice.