How to Block DeepSeek on Your Network and Devices
In early 2025 a wave of governments and agencies barred DeepSeek from official devices. Many contractors, banks, schools and companies followed. Here is what those bans covered and how to apply a block that holds.
First decide what you are blocking
"DeepSeek" can mean three different things on your network. Most government bans targeted the first one. Your policy should say which paths it covers.
The official service
- Website chat and mobile app
- Prompts and files go to the company's own servers
- Covered by most 2025 device bans
The official API
- Scripts and apps that call the developer API
- Often hidden inside third-party tools and plugins
- Easy to miss in a browser-only test
The open models elsewhere
- The models are published with open weights
- Can run on other cloud platforms or on a local machine
- No traffic goes to the company's own servers
Why this matters: a security team worried about data going to the service's servers can stop at paths 1 and 2. A team worried about the models themselves also needs rules on model hubs, local software installs and approved cloud services.
Government device bans: what was announced in 2025
These are the widely reported actions from early and mid 2025. Scope differed: some covered official devices only, some also government networks. Policies change, so check the current official notice before you cite one.
| Who | What was announced | Scope |
|---|---|---|
| Italy | The data protection authority ordered a limitation on processing Italian users' data, and the app left Italian app stores | Country-wide, data protection order |
| US Navy | Memo telling personnel not to use DeepSeek in any capacity | Work and personal use by personnel |
| Pentagon networks | The Defense Information Systems Agency began blocking access on Department of Defense networks | Defence IT networks |
| NASA | Use barred with agency data or on government devices and networks | Agency devices, networks and data |
| US House | Staff told not to install DeepSeek on official phones, computers or tablets | House-issued devices |
| Texas | First US state to ban it on government-issued devices | State devices |
| New York | Ban on state-managed devices and networks | State devices and networks |
| Virginia | Executive Order 46 barred download and use on state devices and state wireless networks | State staff, contractors, state networks |
| Taiwan | Ministry of Digital Affairs said government agencies and critical infrastructure should not use it | Public sector and critical infrastructure |
| Australia | Government entities directed to remove it from government systems and devices | Government devices and systems |
| South Korea | Several ministries restricted it on work devices; new app downloads were paused in the country for a period | Work devices; app stores |
| Czech Republic | Government restricted its use in public administration | Public administration |
None of these were general bans on private citizens, apart from the Italian data protection order. If your organisation works under government contracts, your contract or agency guidance may require the same block on your systems.
Why organisations block DeepSeek
The reasons cited in official notices and company policies fall into a few groups. Most apply to any AI service without a contract, but some are specific to this one.
DeepSeek domains to block
The service runs under one main domain with several subdomains. Blocking the parent domain with all subdomains covers the known hosts. Confirm against your logs, since hosts can be added at any time.
| Host | Used for | Path |
|---|---|---|
deepseek.com | Main site; block with all subdomains | 1 and 2 |
chat.deepseek.com | Web chat | 1 |
api.deepseek.com | Developer API used by scripts and other tools | 2 |
platform.deepseek.com | Developer console and API keys | 2 |
| Look-alike domains | Copycat sites, wrappers and fake download pages using the name | Category rule |
After the 2025 launch, many look-alike domains appeared, some offering fake apps. Fake download pages belong in the malware and phishing category, which you should block anyway. Check any suspicious host with the domain lookup tool.
The blocking playbook, layer by layer
Work through the layers in this order. Each one covers a gap the previous one leaves.
DNS filter
- Add deepseek.com with subdomains to the deny list for every policy.
- Turn on the AI tools category or at least its chat subcategory for the same groups.
- Block outbound DNS to unknown resolvers and known DNS over HTTPS hosts.
Firewall or secure web gateway
- Add a custom URL category with the domains and set it to block.
- Add any DeepSeek application signatures your vendor provides to an application control rule.
- Apply to all segments, including servers, where scripts may call the API.
- Log blocked attempts with user names for your compliance record.
Microsoft Intune
- Add the domains to the Edge URL block list in the Intune settings catalog.
- Use app control to stop installation of any desktop clients.
Google Admin console
- Go to Devices, Chrome, Settings, Users and browsers, URL blocking.
- Add deepseek.com for all relevant organisational units.
- Block extensions that embed it through the Chrome Web Store settings.
MDM for phones and tablets
- Add the DeepSeek app to the blocked apps list on supervised iOS devices.
- On Android Enterprise, keep the work profile limited to approved apps.
- Run an inventory report for existing installs and remove them, as the government directives required.
- Push a DNS profile so mobile data also uses your filter.
Software and cloud policy (path 3)
- Decide whether running the open models on your own hardware is allowed.
- Control local model software with application control.
- Use your cloud provider's model catalogue controls to allow or deny specific models.
A 30-day rollout that avoids surprises
Sudden blocks break scripts and annoy users. A short, staged rollout finds hidden API use before it turns into an outage.
Audit
- Search DNS and proxy logs for any DeepSeek host over the last 90 days.
- List users, devices and servers that touched it, and any software calling the API.
Announce
- Tell staff what is changing, why, and which approved AI tool they can use instead.
- Ask owners of affected scripts or tools to switch providers before the block date.
Block and remove
- Switch DNS, firewall and endpoint rules to block; remove app installs through MDM.
- Keep a helpdesk note ready for the block page.
Verify
- Run the test table, file the evidence and review blocked attempts by user.
- Follow up on repeated attempts, which often point to a business need you missed.
Mobile app vs browser
The government directives focused on the app as much as the website. On phones, network blocks only help while the device is on your Wi-Fi.
Browser and API
- Blocked on every network layer by domain
- Shows your block page in the browser
- API calls from scripts fail with an error
- Off-site laptops need endpoint or browser policy
Mobile app
- Network block works only on your Wi-Fi
- Blocked app lists and removal through MDM
- Existing installs must be found and removed
- Personal phones on guest Wi-Fi fall under the network rule only
VPN bypass and other gaps
A user who wants the tool will try another route. These are the ones that defeat a single domain rule.
How to test and document the block
Regulated teams need proof as well as a working block. Test each layer and keep the results with your policy.
| Test | Expected result | Evidence to keep |
|---|---|---|
| Browse to chat.deepseek.com | Block page | Screenshot and log line |
| Resolve api.deepseek.com from a server | Blocked or sinkholed answer | DNS log entry |
| Install the app on a managed phone | Install refused | MDM report |
| Inventory of existing installs | Zero devices | MDM inventory export |
| Same tests through a consumer VPN | VPN blocked | Firewall log |
| Open a news article about DeepSeek | Loads normally | Note in test record |
| Two third-party chat sites offering its models | Blocked by AI category | Log lines |
Sector notes: who blocks which path
Not every organisation needs the same depth. This table shows the common choices we see by sector. Your own legal and security teams make the final call.
| Sector | Path 1: service | Path 2: API | Path 3: open models | Typical driver |
|---|---|---|---|---|
| Government | Block | Block | Often restricted too | Official directives |
| Defence contractors | Block | Block | Case by case, often restricted | Contract terms, agency guidance |
| Banks and insurers | Block | Block | Allowed only after model risk review | Data residency, supervisor expectations |
| Healthcare | Block | Block | Rarely in use | Patient data rules |
| Universities | Often allowed with warning | Per research group | Usually allowed for research | Academic freedom, research use |
| K-12 schools | Block with other general chat tools | Block | Not relevant | Age limits, student data |
| Private companies | Block or warn | Block unless approved | Allowed by some on own hardware | Data leakage policy |
Writing the policy line
A clear rule in plain words saves arguments later. Adapt one of these, then link the technical controls to it in your change record.
Strict version
- Staff must not install or use DeepSeek apps, websites or APIs on company devices or networks.
- Company data must not be entered into DeepSeek services on any device.
- Running DeepSeek models on company hardware needs written approval from security.
Service-only version
- The DeepSeek app, website and API are blocked on company devices and networks.
- Approved internal platforms may host open models after a security review.
- Unapproved third-party sites offering the models are blocked with other AI chat tools.
Whatever version you choose, pair it with an approved alternative. Staff who have a sanctioned AI tool are far less likely to look for workarounds.
Category-based blocking keeps the gaps closed
A single domain rule handles the official service. Everything else, from copycat sites to resellers of the same models, needs category data that updates every day.
See the AI / LLM Tools category for scope. Government and contractor deployments are covered on federal government web filtering, and export formats on blocklist formats.
Frequently asked questions
Is DeepSeek banned in the United States?
There was no general public ban in 2025. Several federal bodies and states restricted it on government devices and networks, including the US Navy, NASA, the Pentagon's network operator, the House and states such as Texas, New York and Virginia. Check the current status.
Does blocking deepseek.com stop all DeepSeek use?
It stops the official app, website and API. The open models can also run on other platforms or local machines, which a domain block does not cover.
Which DeepSeek domains should I block?
Start with deepseek.com and all subdomains, which include the chat, API and platform hosts. Confirm against your logs.
Do I need to block the mobile app separately?
Yes, for devices that leave your network. Use MDM to block or remove the app; the network rule only applies on your Wi-Fi.
How are copycat DeepSeek sites handled?
They use different domains. A category rule for AI tools, updated daily, catches them where a fixed list does not.
Will blocking DeepSeek break any of our software?
Only software that calls its API. Search your logs for api.deepseek.com before the block date and ask the owners of those tools to switch to an approved provider.
Should universities block DeepSeek?
Many universities leave it open with a warning, or restrict it on administrative networks only, because researchers study the models. Staff handling student or grant data are often covered by stricter rules.
Can I check whether a new AI site offers DeepSeek models?
Look up the domain with our category lookup. If it is an AI chat tool, an AI category rule blocks it whatever model it runs.
We are a contractor. Do agency bans apply to us?
That depends on your contract and the agency's guidance. Many contractors apply the same block on systems that handle agency data. Ask your contracting officer or legal team.
Block AI services by category, even air-gapped
License category data with 16,000+ AI-tool domains, daily updates and on-premise delivery for government and enterprise networks.
DeepSeek is a trademark of its owner. Microsoft, Intune and Edge are trademarks of Microsoft Corporation. Google and Chrome are trademarks of Google LLC.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.