How to block Spotify on your network
Spotify reaches users through a browser tab, a desktop app, phones, smart speakers and embedded players on other websites. A block that closes only one of those paths looks fine in testing and fails on Monday morning.
This guide maps every path first, then shows which control closes it: DNS, firewall, endpoint policy or MDM. It ends with tests you can repeat and a way to keep the block current through streaming media category data.
Why organisations block Spotify
Music streaming is rarely a security threat by itself. The reasons to block it are about capacity, licensing and focus, and they differ a lot by sector. Name yours before you choose a method, because the reason decides the scope.
Shared and metered links
One audio stream is light. Hundreds of devices streaming all shift on a branch office link, a ship, a site with satellite backhaul or a busy school can add up.
Public performance
Personal music subscriptions are generally licensed for personal use. Playing them through shop, gym or restaurant speakers can raise public performance licensing questions, so many businesses block the consumer app.
Lessons and exams
Schools block music services during lessons and exams, and often allow them in study halls or after hours. The block is a timetable issue, not a moral one.
Unapproved installs
The desktop client can install into the user profile. Organisations with strict application allowlists block it to keep the software inventory clean.
Account sharing and phishing
Fake "your subscription failed" pages are a common lure. Blocking the service does not stop phishing, but it reduces the number of streaming logins staff type on work devices.
Fair use for visitors
Hotels, clinics and venues often throttle or block streaming on guest networks so that the connection stays usable for everyone waiting in the lobby.
Decide the scope in one line. For example: "Block Spotify on the staff and student SSIDs from 08:00 to 16:00, allow on guest Wi-Fi, allow for the marketing team." Every rule you build later should map back to that sentence.
Spotify domains and what each one does
Spotify does not publish a complete domain list for firewalls, and its infrastructure changes. The domains below are widely seen in traffic from the web player and apps. Use them as a starting point, then check your own DNS logs.
| Domain | Role in the service | Effect of blocking | Advice |
|---|---|---|---|
spotify.com | Website, web player at open.spotify.com, login, account pages and many API hostnames | Web player and sign in stop working | Block with subdomains |
scdn.co | Static content: cover art, images, scripts used by the player | Players lose artwork and much of the interface | Block with subdomains |
spotifycdn.com | Content delivery for images, playlists artwork and media assets | Closes a common leak path for the apps | Block with subdomains |
spoti.fi | Short links used when people share tracks and playlists | Shared links stop resolving | Block |
| Shared CDN hostnames | Some audio is delivered through large third party content networks under Spotify named hostnames | Blocking the whole CDN would break many unrelated sites | Block only exact hostnames |
The last row is the trap. Never block an entire shared content delivery network to stop one service, because thousands of legitimate sites use the same network. Block only the exact Spotify hostnames you see, or let an application control signature handle it.
Found an unfamiliar hostname in your resolver logs? Paste it into our domain category lookup to see which categories it carries before you add it to a rule.
Methods: close each path with the right layer
No single control covers all five paths. Stack the layers below from the network edge inward. Small offices can stop after the first two, while managed fleets need all of them.
Stop name resolution for the domain family
Add spotify.com, scdn.co, spotifycdn.com and spoti.fi to your DNS filter block list, including subdomains. This covers every device that uses your resolver, including smart speakers that cannot run an agent.
- Force all devices to use your resolver: block outbound port 53 to other servers at the firewall.
- Block known public DNS over HTTPS endpoints, or set browser policy so they use your resolver.
- If you run a home style resolver appliance, add the domains as wildcard entries rather than exact names.
Combine a URL rule with an application signature
A URL or domain rule catches the web player. An application control signature catches the desktop and mobile apps, which may reuse open connections or reach hostnames your list does not have yet.
- Create a custom URL category named for the service and add the domain family to it.
- Enable the vendor's music streaming or Spotify application signature and set it to block or to a bandwidth limit.
- Apply the policy to the right source zones and schedules, then move it above any broad allow rule.
Block the desktop client from installing or running
Network blocks do not remove the app. On managed endpoints, prevent the client from installing and block the web player in the browser policy, so the device behaves the same on home Wi-Fi.
- Microsoft Intune: use an application control policy to block the Spotify executable, and an Edge policy with a URL block list for the web player.
- Endpoint web filtering, where licensed, can block streaming categories on and off the corporate network.
- macOS: use your MDM to restrict the application bundle and push browser URL block lists.
Hide or block the mobile app
On supervised iPhones and iPads, use your MDM to block or hide the app. On Android Enterprise, block it in managed Google Play. Personal phones on guest Wi-Fi are covered only by layers 1 and 2.
- Remember that mobile data bypasses your network completely.
- Downloaded playlists play offline, so a network block does not silence them.
Google Admin console URL blocking
For managed Chromebooks, add the domain family to the URL block list for the relevant organisational unit and block the Android app if Play apps are enabled. Schools can scope this to student units only.
Full block or partial access?
Many organisations do not need a full block. Compare the two approaches before you commit, because a rule that is too strict gets disabled quietly after the first complaint from a manager.
Full block
- Simple to explain and audit.
- Right for exam rooms, call centres, secure sites and public performance spaces.
- Breaks embedded players on third party pages.
- Needs every layer, including MDM, to hold.
Partial access
- Time windows: allow at lunch and after hours.
- Group exceptions: allow for marketing or social media teams.
- Network split: block on staff Wi-Fi, allow on guest with a bandwidth cap.
- Rate limit: keep the app working but cap its share of the link.
Tip for venues: if the goal is background music in a shop or restaurant, block the consumer app on the venue network and use a service that is licensed for business use. That solves the licensing question rather than only the network one.
If streaming capacity is the real worry, our guide to blocking streaming sites to save bandwidth covers throttling and quality of service for video and audio together.
How users get around a Spotify block
Knowing the usual workarounds lets you close them in your design. This list is for administrators planning controls; it describes what to defend against, not how to do it.
VPN apps and browser extensions
Block the VPN and proxy category and VPN application signatures, and stop users installing extensions on managed browsers.
Encrypted DNS
Browsers and phones can send DNS over HTTPS to public resolvers. Disable it by policy or block known endpoints so your resolver stays in the path.
Mobile data and hotspots
Phones on cellular data never touch your network. Only MDM controls reach them, and only on devices you manage.
Offline downloads
Playlists downloaded at home keep playing. Block the app on managed devices if offline playback matters to your policy.
Web proxies and mirrors
Unofficial players and proxy sites appear often. A daily refreshed Streaming Media and proxy category feed catches them faster than a manual list.
Long lived sessions
Connections opened before the rule can survive for a while. Clear active sessions on the firewall after deploying, then test again.
Speakers, TVs and meeting room devices
Devices with a built in music client are easy to forget. They cannot run an endpoint agent or take an MDM profile, so the network is the only place you can control them.
| Device type | What reaches it | Control that works |
|---|---|---|
| Smart speakers | Casting from phones and voice requests to the built in client | DNS block on the IoT network, plus forced use of your resolver |
| Smart TVs and streaming sticks | Preinstalled music app that signs in with a personal account | Separate VLAN with its own DNS policy and firewall rule |
| Meeting room systems | Casting or a browser on the room display | Kiosk browser policy and the same URL block list as staff devices |
| Shop and venue players | Staff phones connected to the sound system | Block the consumer app on the venue network and use a licensed business music service |
Keep IoT on its own network. Putting speakers and TVs on a dedicated SSID or VLAN lets you apply a stricter DNS policy to them without touching laptops and phones.
How to test the Spotify block
Test from the networks and devices your users actually have, not only from the admin laptop. Record the result of each check so you can repeat the same set after every firmware or policy change.
- Resolve spotify.com, scdn.co and spotifycdn.com from a client. Expect the block page address or no answer.DNS
- Open the web player in a clean browser profile. Expect your block page, not a time out.Browser
- Start the desktop app after a full restart and play a track that is not downloaded.Desktop app
- Open the mobile app on Wi-Fi with cellular data switched off.Mobile
- Load a news page that embeds a player and confirm the rest of the page works.Side effects
- Repeat on the guest SSID and from an exempt group to confirm exceptions work.Scope
- Check the schedule edges, for example one minute before and after a lunchtime window.Schedules
- Review firewall and DNS logs a week later for new Spotify hostnames that still pass.Follow up
Category based blocking with our database
Hand built lists for one service age quickly. Category data keeps the rule current as the service and its look alikes change. That is what vendors and MSPs license our database for.
Categories that matter for music services
- Streaming Media: music and video services, web players and their delivery domains.
- Podcasts: podcast hosts and directories, kept separate so you can allow training content.
- Arts and Entertainment: artist sites, lyrics and music news.
- VPN / Proxy / Anonymizers: the usual bypass route.
How it keeps a block current
- A domain can carry several categories, ranked by how much of the site they describe.
- New domains are checked again after a week and after a month, because many add content after launch.
- Daily delta files update your rules without a full reload.
- Exports can include DNS RPZ zones, hosts files and firewall external dynamic lists. See blocklist formats.
If you build filtering products, the full web filtering database runs inside your own systems as files, with a lookup API included. Product teams embedding it should read our OEM licensing overview. MSPs can find planning notes on the MSP web filtering page.
Spotify blocking FAQ
Does blocking spotify.com stop the Spotify app?
Not on its own. The apps also load images, scripts and audio from content delivery domains such as scdn.co and spotifycdn.com, and part of the audio comes from shared third party CDN hostnames. Block the Spotify domain family and add an application control rule where your firewall offers one.
Can I block Spotify but allow podcasts from other sources?
Yes. Podcasts are published on many platforms. Block the Spotify domains or application and leave the Podcasts category open, or allow a specific podcast host that your training team uses.
Why does Spotify keep playing after I applied the block?
Spotify caches audio for offline listening, so downloaded playlists keep working without any network access. Long lived connections that were open before the rule also keep running until they drop. Restart the app and test with a track that has not been downloaded.
Should I block Spotify embeds on other websites?
If you block the Spotify domain family, embedded players on news and brand sites will show as empty boxes. The rest of those pages keep working, so most organisations accept this.
Is music streaming really a bandwidth problem?
One audio stream is small compared with video. The issue is scale: hundreds of devices streaming all day on a shared or metered link, or on a site with a small uplink. Measure your own traffic before you decide.
How do I keep a Spotify block current?
Use a category feed that is refreshed daily for Streaming Media and related domains, keep your firewall application signatures updated, and review DNS logs for new Spotify hostnames every quarter.
Power streaming controls with category data
120 million categorized domains, 59 categories and daily updates, delivered as files for your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Spotify is a trademark of Spotify AB. Microsoft, Intune and Edge are trademarks of Microsoft Corporation. Google, Chromebook and Google Play are trademarks of Google LLC.
Apple, iPhone, iPad and macOS are trademarks of Apple Inc. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.