Who blocks Netflix, and why
Netflix is rarely a security risk, and it is a legitimate service that many staff use at home. Organisations block it on their own networks because long form video uses a lot of capacity for a long time, and because it is clearly outside the purpose of most work and school networks.
Offices and branchesProtect video calls and cloud apps on modest links. One HD stream can use several megabits per second for hours.
Schools and universitiesKeep campus bandwidth for learning, and stop lessons being replaced by series binges on student devices.
Hotels and hostelsSome offer streaming only on a premium tier, or limit it on free guest Wi-Fi during busy evening hours.
Clinics and care homesMedical devices and booking systems share the same connection, so streaming is limited on staff networks.
Metered linksShips, remote sites and satellite connections pay per gigabyte, which makes video streaming expensive.
Shared and public computersLibraries and computer labs keep machines free for the people waiting to use them, which long viewing sessions prevent.
Licensing of public screensShowing streamed content on public screens in a venue can raise licensing questions, so venues block it on display devices.
Block, shape or schedule?
Before you block Netflix outright, decide whether a softer control would meet the goal. Many networks only need to stop streaming from crowding out other traffic.
| Your goal | Best control | How it feels to users | Where it fits |
|---|---|---|---|
| Stop all streaming, no exceptions | Full block by category and application | Netflix does not load at all | Offices, classrooms, kiosks, metered links |
| Protect bandwidth but allow light use | Traffic shaping on the streaming application | Lower picture quality, longer buffering | Guest Wi-Fi, student residences, staff lounges |
| Keep focus during set hours | Scheduled block on DNS filter or firewall | Works in the evening, blocked in the day | Boarding schools, shift workplaces |
| Offer streaming as a paid extra | Separate SSID or captive portal tier with its own policy | Free tier blocks streaming, premium tier allows it | Hotels, marinas, campsites |
| Allow some people only | Group based rules on firewall and endpoint | Normal for the group, blocked for others | Media companies, film schools |
Rule of thumb: if the problem is capacity, shape it. If the problem is purpose or policy, block it. If the problem is timing, schedule it. Write down which one applies so future changes stay consistent.
Verified Netflix domains
These domains belong to Netflix and carry the website, app API, artwork, player code and the video itself. Netflix can add new hostnames at any time, so treat the table as the minimum and let a category rule cover the rest.
| Domain | What it carries | Why it matters for blocking |
|---|---|---|
netflix.com | Website, sign in, browsing, account pages and app API | Blocks the interface, but not video already resolved elsewhere |
nflxvideo.net | The video streams, served from Netflix delivery servers | The most important domain for stopping playback |
nflximg.net | Artwork, thumbnails and images | Stops the catalogue from rendering |
nflximg.com | Further image delivery | Include with nflximg.net |
nflxext.com | Player code, scripts and static files | Breaks the web player |
nflxso.net | Content delivery for assets and media | Closes a common leak in partial blocks |
Two practical habits make the list more reliable. First, always block the registrable domain with every subdomain, never a single hostname. Second, check your DNS logs a few days after rollout for any remaining Netflix related lookups that still resolve, and add them to your rule or report them to your category provider.
Why IP blocking does not work well for Netflix
Netflix runs its own delivery network, and many of its servers sit inside internet providers' networks close to users. The addresses you see differ by location and change over time. Blocking by domain, category or application signature is far more reliable than chasing addresses.
To check how a hostname from your logs is classified, use our domain lookup tool. It returns the ranked categories for each domain.
The five layer Netflix blocking stack
Each layer catches traffic the others miss. Small sites can stop after layer two. Organisations with managed laptops and phones should go all the way down to layer five.
Router or access point
The quickest start for a small office, café or holiday let.
- Add netflix.com and the nflx domains to the blocked sites list.
- Use keyword blocking for "netflix" and "nflx" if exact matching is all the router offers.
- Apply to the guest SSID, staff SSID or both.
DNS filter
The baseline for any network, hosted or on premise.
- Block the Streaming Media category, or add the Netflix domains with subdomain matching.
- Hand out the resolver via DHCP on every VLAN in scope.
- Log queries so you can see which devices try to stream.
Firewall
Closes the DNS bypass and adds application detection.
- Block the Netflix application or the streaming media URL category.
- Allow DNS only from your resolver and block DNS over TLS on port 853.
- Consider traffic shaping instead of a block on guest networks: low resolution streaming still works but cannot flood the link.
Endpoint policy
Keeps the block on laptops wherever they connect.
- Windows: push a URL blocklist with the Netflix domains to Edge and Chrome through Intune, or add them as block indicators in your endpoint protection.
- Chromebooks: add the domains to Blocked URLs in the Google Admin console and block the Netflix Android app.
- Mac: a content filter profile from your MDM.
Mobile device management
The only control that works on mobile data.
- Supervised Apple devices: hide or block the Netflix app and add the domains to the web content filter.
- Android Enterprise: do not approve Netflix in managed Google Play on fully managed devices.
- Block VPN apps and profiles where policy allows.
Netflix apps, smart TVs and consoles vs the browser
Most Netflix viewing happens in apps, not browsers. That changes what users see and where leaks appear.
In a browser
- A blocked netflix.com shows your block page or a connection error.
- Browser secure DNS can skip your resolver. Disable it with managed browser policy.
- Cached pages may show artwork until the cache expires.
In apps and on TVs
- The app shows a generic "cannot connect" message, often with an error code, never your block page.
- Smart TVs and streaming sticks follow your DNS and firewall, so layers 2 and 3 cover them.
- Games consoles behave the same way, so put them on a segment with a clear policy.
- Downloaded episodes on phones and tablets play offline. No network control can stop that, only MDM.
Segment entertainment devices
Put smart TVs, streaming sticks and consoles on their own VLAN or SSID. You can then allow Netflix in a staff lounge, block it in meeting rooms and keep guest Wi-Fi separate, without one policy fighting another.
Example policy by network segment
| Segment | Netflix | Other streaming | Notes |
|---|---|---|---|
| Staff and corporate devices | Blocked | Blocked or shaped | Endpoint policy follows laptops off site |
| Student or learner network | Blocked | Blocked except approved education video | Pair with Restricted Mode on YouTube |
| Guest Wi-Fi | Shaped | Shaped | Terms of use explain the limit |
| Meeting rooms and signage | Blocked | Blocked | Displays should only reach business services |
| Staff lounge or residence TVs | Allowed after hours | Allowed after hours | Separate VLAN with a schedule |
Side effects to expect
Blocking Netflix is low risk, but tell support staff about these before they get the first ticket.
| Side effect | Cause | What to do |
|---|---|---|
| The fast.com speed test fails or shows odd results | It is run by Netflix and measures against Netflix delivery servers | Use another internal speed test, or allow fast.com for IT staff only |
| Netflix trailers on news sites do not play | Embedded players load from Netflix domains | Expected, no action |
| Netflix games on phones fail | Games sign in through Netflix accounts | Expected under the same policy |
| Users report "Netflix error" on hotel TVs | The TV app is blocked on guest Wi-Fi | Make sure guest terms explain the streaming policy |
VPN and proxy bypass
Streaming services and VPNs have a long history together, since people use VPNs to reach other regions' catalogues. Expect VPN attempts after you block Netflix, and close the common routes.
- Block the VPN / Proxy / Anonymizers category on DNS and firewall.
- Turn on VPN application and protocol detection on the firewall.
- Allow DNS only to your resolver, block port 853.
- Disable secure DNS in managed Chrome and Edge.
- Return no result for use-application-dns.net so Firefox stays on your DNS.
- Return no result for mask.icloud.com and mask-h2.icloud.com to signal that Private Relay is unavailable.
- Block installation of VPN apps on owned phones through MDM.
- Watch DNS logs for spikes in VPN and proxy lookups after the block goes live.
Our VPN and proxy category covers consumer VPN brands, free web proxies and anonymizers, with new ones added daily.
How to test the Netflix block
Test each layer you deployed, from each kind of device. Clear DNS caches between tests, and remember that apps cache content for a while.
| # | Test | How | Pass |
|---|---|---|---|
| 1 | DNS | nslookup netflix.com and a host under nflxvideo.net | Block address or no answer |
| 2 | Browser | Open netflix.com in a private window | Block page or refused |
| 3 | Smart TV | Launch the Netflix app on a TV on the in scope network | Connection error |
| 4 | Phone on Wi-Fi | Open the app and play a title | Playback fails |
| 5 | Phone on cellular | Managed phone, Wi-Fi off | App missing or blocked |
| 6 | Bypass | Public DNS set manually on a test laptop | Still blocked |
| 7 | Off site laptop | Managed laptop on home broadband | Endpoint policy blocks |
Rollout checklist
- Measure streaming traffic for a week before the change, so you can show the effect afterwards.
- Agree the scope per segment: block, shape or schedule.
- Announce the change and the reason to staff, students or guests.
- Deploy layers 2 and 3 first, then endpoint and MDM policies.
- Run the seven tests above and record results with the date.
- Check bandwidth graphs again after two weeks.
- Review exceptions every quarter and remove ones no longer needed.
- Retest after firewall firmware updates, which can reset profiles.
Block every streaming service with category data
Netflix is rarely the only streaming service a network needs to control. Category blocking covers all of them at once, including new services and regional platforms you have never heard of.
Netflix and its delivery domains are in our Streaming Media category. Domains carry several ranked categories, so you can tell a streaming service from a film news site that only embeds trailers. Read more about how streaming sites are classified.
MSPs running dozens of client networks benefit most, because one category feed replaces a separate streaming list per client. Each client policy simply switches Streaming Media to block, shape or allow, and new services are covered everywhere at once.
Vendors and service providers
Firewall, DNS filter, router and ISP vendors embed the database to offer streaming controls to their customers. The ISP web filtering page covers operator use cases, and OEM licensing covers embedded products.
Hospitality and guest networks
Hotels and venues use category policies per SSID. Our hospitality web filtering page explains typical guest network setups. Licensed exports include DNS RPZ, hosts files and firewall external dynamic lists.
Netflix blocking FAQ
Why does Netflix still play after I blocked netflix.com?
Video is delivered from separate domains such as nflxvideo.net, with images and code from nflximg.net, nflximg.com, nflxext.com and nflxso.net. Block the whole set, or use a Streaming Media category that includes them.
Can I block Netflix by IP address?
It is unreliable. Netflix serves video from its own delivery servers, many of which sit inside internet providers' networks, and the addresses vary by location. Domain, category and application based blocking work better.
Will blocking Netflix affect the fast.com speed test?
It can. The fast.com speed test is run by Netflix and measures speed against Netflix delivery servers, so a full block of Netflix delivery domains may stop it from working.
How do I block Netflix on smart TVs?
Smart TVs use your network's DNS and firewall, so a DNS filter and firewall rule cover them. Put TVs and streaming sticks on their own network segment so you can apply a specific policy.
Is there a way to block all streaming services, not only Netflix?
Yes. Block the Streaming Media category in your DNS filter or firewall. A category database assigns new streaming domains as they appear, so the policy stays complete without list updates.
Do downloaded Netflix episodes still play after the block?
Yes. Episodes downloaded to a phone or tablet play offline, so no network control stops them. On owned devices, MDM can remove or block the app; on personal devices the network block only stops new streaming and downloads.
Is traffic shaping better than blocking Netflix on guest Wi-Fi?
Often, yes. Shaping keeps guests satisfied with lower quality streaming while protecting capacity for everyone else. Blocking is clearer when the network has no entertainment purpose at all.
Streaming controls for your product or network
License 120 million categorized domains, 59 categories and daily updates, delivered as files that run in your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Netflix is a trademark of Netflix, Inc. Microsoft, Intune and Edge are trademarks of Microsoft Corporation. Google, Chrome, Chromebook and Google Play are trademarks of Google LLC.
Apple and iCloud are trademarks of Apple Inc. Firefox is a trademark of the Mozilla Foundation. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.