To permanently block outgoing traffic to specific domains you should create a new anchor file and add it to pf.conf.

1. Create an anchor file *org.user.block.out* in /private/etc/pf.anchors 

        sudo touch /private/etc/pf.anchors/org.user.block.out

 with the following content and a trailing empty line

	    mybadhosts = "{ www.domain.com, domain.com, www.domain2.com, domain2.com }"
        mybadports = "{ 443, 80 }"

        block drop out proto tcp from any to $mybadhosts port $mybadports

 The additional domain names in mybadhosts are just an example how to add additional domains. The same goes for port 80 in mybadports.

 A simple but less flexible solution is:

        block drop out proto tcp from any to domain.com port 443

2. Modify the file /private/etc/pf.conf but keep a trailing empty line

 original file:

        scrub-anchor "com.apple/*"
        nat-anchor "com.apple/*"
        rdr-anchor "com.apple/*"
        dummynet-anchor "com.apple/*"
        anchor "com.apple/*"
        load anchor "com.apple" from "/etc/pf.anchors/com.apple"

 to

        scrub-anchor "com.apple/*"
        nat-anchor "com.apple/*"
        rdr-anchor "com.apple/*"
        dummynet-anchor "com.apple/*"
        anchor "com.apple/*"
        anchor "org.user.block.out"
        load anchor "com.apple" from "/etc/pf.anchors/com.apple"
        load anchor "org.user.block.out" from "/etc/pf.anchors/org.user.block.out"

3. Parse and test your anchor file to make sure there are no errors:

        sudo pfctl -vnf /etc/pf.anchors/org.user.block.out

4. Now modify /System/Library/LaunchDaemons/com.apple.pfctl.plist from 

	    <array>
		    <string>pfctl</string>
		    <string>-f</string>
		    <string>/etc/pf.conf</string>
	    </array>

 to

	    <array>
		    <string>pfctl</string>
		    <string>-e</string>
		    <string>-f</string>
		    <string>/etc/pf.conf</string>
	    </array>

 You have to disable System Integrity Protection to accomplish this. After editing the file reenable SIP. After rebooting your Mac pf will be enabled (that's the -e option).

 Alternatively you may create your own launch daemon similar to the answer here: [Using Server 5.0.15 to share internet WITHOUT internet sharing][1].

After a system update or upgrade some of the original files above may have been replaced and you have to reapply all changes.


  [1]: https://apple.stackexchange.com/questions/228936/using-server-5-0-15-to-share-internet-without-internet-sharing