How to block Bluesky on your network

Bluesky is a social network built on an open protocol. That design is good for users who want choice, and it is the reason a single domain rule is not quite enough for network admins.

This guide covers the domains, the layers that work, and how to keep the block working as new apps appear.

Schools and districts Businesses and MSPs Family networks

Why organisations block Bluesky

Bluesky opened to the public in early 2024 and grew fast. For admins, it falls into the same policy bucket as any other open social feed: useful to some adults, distracting or risky for others.

Age and audience

Bluesky's terms set a minimum age of 13, and many places set higher limits by law. Primary schools and junior clubs usually block it outright.

Mixed content

Users and community moderators choose many of their own filters. A student account may see content that school policy would not allow.

Direct messages

Private messages let strangers contact children. Schools and youth organisations treat that as a safeguarding risk on their networks.

Focus at work and school

Endless feeds pull attention away from lessons and work. Many employers block all social feeds for most staff groups.

Consistency

If X, Threads and Facebook are blocked, leaving Bluesky open is a gap students and staff will find quickly.

Records and conduct

Regulated businesses may need to keep client communication off public social platforms and their messaging tools.

How Bluesky works, in admin terms

You do not need to understand the protocol in depth. You only need to know that the official app is one of several ways into the same network, and each one talks to servers you may want to block.

Step 1

A user opens the official app or website, or a third-party app built on the same protocol.

Step 2

The app signs in to an account server. For most users that is Bluesky's own hosting on bsky.social.

Step 3

Posts and feeds are gathered by network services that Bluesky runs, many on bsky.network and bsky.app hosts.

Step 4

Images and video are fetched from content hosts. These names can change as the service grows.

What this means for you: block the three Bluesky domains below, then let the Social Networking category catch third-party apps, web viewers and mirrors. Self-hosted servers run by others will not be on any short list.

Bluesky domains to block

These are the well-known official domains. Block each one with all subdomains. Services like this change their hosts over time, so treat the list as a starting point and confirm against your own logs.

bsky.app
Block

The main web app and many of the API hosts the official mobile apps use.

bsky.social
Block

The default account service where most users sign in, plus the default user handles.

bsky.network
Block

Network infrastructure such as account hosting and relay services run by Bluesky.

Third-party clients
Category rule

Other apps and web viewers that read the same network under their own names.

Cloud hosting ranges
Do not block

The servers sit on shared cloud infrastructure that also hosts unrelated sites and school tools.

Unsure about a host that appears in your logs? Check it in the domain category lookup. If it is labelled Social Networking, it belongs in the same rule.

Methods: from the network edge to the device

Each layer catches something the previous one misses. Most sites need the first two; schools and companies with managed devices should use all four.

Point every SSID and VLAN at your filtering resolver through DHCP.
Block bsky.app, bsky.social and bsky.network as wildcard entries.
Block the Social Networking category for student and general staff groups.
Redirect outbound port 53 to your resolver and block DNS over TLS on port 853.
No resolver of your own? A managed DNS filter gives you the same controls.

Add the Bluesky domains to a URL filter block profile.
Use application control if your firewall offers a Bluesky signature.
Block QUIC on UDP 443 for filtered segments so server names stay visible.
Where policy allows TLS inspection, exclude banking, health and similar categories.

In Google Admin, add the three domains to the URL block list for the right organisational units.
In Microsoft Intune, push an Edge URL block list or a web content filter for social networking.
Disable browser DNS over HTTPS by policy so the browser uses your resolver.
Allow only approved extensions, which stops proxy add-ons.

Block the Bluesky app and known third-party clients from install on supervised iOS devices.
On Android Enterprise, allow only approved apps from managed Google Play.
Push a DNS or web content filter profile so rules apply on mobile data.
Stop users adding VPN profiles or changing private DNS.

Home router owners can add the three domains on the router's website blocking page, then point the router's DNS at a filtering resolver. For a wider plan across every social platform, read how to block social media at work.

App vs browser: where the block holds

The same rule behaves differently depending on how the person reaches Bluesky and which network they are on.

Access route	On your Wi-Fi	On mobile data	Main control
Official website	Blocked by DNS and category rules	Blocked only on managed browsers	DNS plus browser policy
Official mobile app	Blocked when the three domains do not resolve	Not blocked unless the device is managed	DNS plus MDM
Third-party app	Blocked if it uses Bluesky hosts or is in the category	Not blocked unless managed	Category rule plus MDM app allow list
Web viewer or mirror site	Blocked by the Social Networking category	Blocked on managed browsers	Category rule
Personal phone, BYOD	Covered by the guest or BYOD SSID rules	Outside your control	Phone policy

Closing the bypass routes

Social apps attract workarounds. These are the common ones and the control that closes each.

VPN apps

Block the VPN / Proxy / Anonymizers category and VPN signatures, and stop VPN profile installs through MDM.

Encrypted DNS

Turn off DNS over HTTPS in browsers by policy, block port 853, and enforce private DNS settings on managed Android devices.

Third-party apps

An app allow list on managed devices beats chasing each client by name. On the network, the category rule does the work.

Web proxies

Proxy sites appear daily. See how to block proxy sites for the full set of controls.

Hotspots

A friend's phone sharing mobile data is outside any network rule. Only a phone policy and device controls cover it.

Self-hosted servers

Some users run their own account servers on their own domains. These are rare on school networks; the category rule and logs are your safety net.

Bluesky features that change the admin picture

A few platform features cause confusion when admins first look at Bluesky traffic. None of them need special rules, but knowing them saves time when reading logs.

Custom domain handles
No extra rule

Users can show a domain they own as their name. The posts still load through Bluesky's services, so the main block still applies.

Custom feeds
Category rule

Feeds can be built by third parties. Some feed services sit on their own domains, which the Social Networking category is meant to catch.

Embedded posts
Watch logs

News sites and blogs can embed Bluesky posts. With the domains blocked, embeds show as empty boxes, which is expected.

Direct messages
Same domains

Private chat runs on the same service. Blocking the core domains stops messaging along with the feed.

Video and images
Check logs

Media can come from separate content hosts. If posts load without images, the block is only partial: look for the missing host.

Troubleshooting a block that leaks

When a user reports that Bluesky still works, match the symptom to the most likely cause before changing any rules.

Symptom	Likely cause	What to do
Website blocked, app still works	The app reached a host outside your three entries, or the phone uses private DNS.	Check that wildcards are on; read the device's DNS log entries.
Works only in one browser	That browser uses its own encrypted DNS.	Disable browser DNS over HTTPS by policy.
Feed loads but sign-in fails	Partial block from cached sessions.	Wait for cached DNS to expire, or restart the app, then test again.
A third-party app still works	The app uses its own domain that is not yet in your list.	Rely on the Social Networking category; check the domain in the lookup tool.
Works on one device only	VPN profile, private DNS or an MDM exemption on that device.	Inspect the device's network settings and policy group.

Do not escalate to IP blocks. Blocking the cloud address ranges behind Bluesky would break unrelated services. Fix the DNS path and the device settings first.

Test the block before you announce it

Use a test device set up like a real student or staff device, with mobile data off, and a test account.

Run nslookup bsky.app on a filtered client and confirm the block answer.
Repeat for bsky.social and a subdomain of bsky.network.
Open the website in two browsers and confirm the block page shows.
Open the official app; the feed should fail to refresh and sign-in should fail.
Try a third-party client on a test phone and confirm it cannot load posts.
Install a free VPN and confirm it cannot connect.
On a managed device, switch to mobile data and confirm MDM still blocks the app.
Check DNS and firewall logs for the blocked events and their categories.

Recommended settings by type of network

Start here, then adapt to your own policy and local rules.

Network	Suggested rule	Notes
Primary school	Block Social Networking and VPN categories everywhere.	Block the app on all school tablets.
Secondary school	Block for students; decide staff access in policy.	Communications staff may need a scheduled exception.
Office	Block for most groups, allow for marketing and communications.	Use groups rather than individual exceptions.
Family home	Block on children's device profile only.	Talk about it first; agree the rule together.
Library or youth club	Block on the network used by minors.	Adults can use a separate, lighter profile.
Guest Wi-Fi	Usually allowed.	Block adult, malware and phishing categories as a baseline.

Schools can read more in K-12 school web filtering, and offices in web filtering for small offices.

Policy decisions to make first

Technical steps are the easy part. These questions decide how the rule is set up and how it is received.

Is the rule about Bluesky only, or about all social feeds? If all, lead with the category rule.
Which groups are covered: students, all staff, guests, or only devices used by minors?
Who can approve an exception, and for how long? Time-limited exceptions are easier to review.
Does the school or company itself post on Bluesky? If so, the communications team needs access.
Will the rule apply at all hours or only during lessons and working time?
How will you handle repeat VPN attempts: technical block only, or a conversation as well?
Where is the rule written down, and when will it be reviewed next?
Who is told before it goes live: help desk, heads of year, team leads, parents?

Schedules and group policies are easier on a filter that supports them. See filtering profiles and networks for one way to organise groups.

What to tell people when the block goes live

Clear, short communication cuts tickets and bypass attempts. It also reminds everyone that filtering is one layer of a wider approach.

Students

Say that school Wi-Fi is for learning, that VPN use breaks the rules, and who they can talk to if something online upsets them.

Parents

Explain that the school blocks Bluesky on its own Wi-Fi and devices, not on personal phones using mobile data.

Staff

State whether staff may use social apps on the staff network, and remind them not to contact students through personal accounts.

Safeguarding lead

A web filter blocks categories of sites. Concerns about a child's wellbeing go through your safeguarding process, not the filter settings.

Keep the rule current with category data

Open social networks spawn new clients, viewers and mirrors. A daily-refreshed Social Networking category covers them without anyone editing a list.

120Mcategorized domains

20Mmost visited domains, covering 99.99% of web traffic

~300knew domains categorized per day, rechecked after a week and a month

59web filtering categories in one file

New domains are checked again after a week and after a month, because many sites add content only after launch. That matters for viewers and mirrors, which often start as empty pages.

Vendors build this into their products through the web filtering database. Related guides: how to block X (Twitter), how to block Threads and how to block Reddit.

Bluesky blocking FAQ

Which domains do I block to stop Bluesky?

Start with bsky.app, bsky.social and bsky.network, each with all subdomains. These cover the main web app, the default account service and the main network infrastructure. Lists change, so confirm against your own logs and use the Social Networking category for third-party apps.

Does blocking bsky.app stop every Bluesky app?

Not always. Bluesky runs on an open protocol, and third-party apps can reach the network through other domains. Blocking bsky.social and bsky.network as well, plus the Social Networking category, closes most of these routes.

Will blocking Bluesky break anything else?

Blocking the Bluesky domains themselves should not affect unrelated services. Do not block the cloud hosting provider IP ranges behind them, because many unrelated sites and school tools share that infrastructure.

What is the minimum age for Bluesky?

Bluesky's terms of service set a minimum age of 13, and local laws may set a higher age. Many primary schools block it outright for that reason. Check the current terms, as they can change.

Can I block Bluesky on mobile data?

Only on devices you manage. Use MDM to block the app and apply a device-level filter or DNS profile. On personal phones using mobile data, a network rule cannot reach the device.

How does a category database help with Bluesky?

New clients, viewers and mirror sites for open social networks keep appearing. When they are categorized daily as Social Networking, a category rule blocks them without manual list edits.

Put daily category data behind your filter

For filter vendors, MSPs and edtech makers: 120 million domains in 59 categories, delivered as files that run in your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.

License the database

Bluesky is a trademark of Bluesky Social, PBC. Google, Chrome and Android are trademarks of Google LLC; Apple and iOS of Apple Inc. (iOS used under licence); Microsoft, Edge and Intune of Microsoft Corporation; other names belong to their respective owners.

These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.