How to block Telegram on your network
Telegram is harder to block than most chat apps. It can connect by IP address without DNS, it has proxy support built in, and its bot interface is a favourite tool for malware. This runbook covers all three problems.
Why security teams block Telegram
For many organisations, Telegram is not a productivity question. It is a security one. These are the threats that come up most in incident reviews, rated by how often they push teams to act.
Bot API used for command and control
Malware posts stolen data and receives instructions through a Telegram bot. The traffic looks like ordinary HTTPS to a well-known service.
Data exfiltration by staff
Large file limits and desktop clients make it easy to move documents out of the company, out of reach of email DLP.
Stolen data markets
Public channels trade leaked credentials and data. Teams block them on work devices to avoid accidental downloads.
Phishing and scams
Investment scams and fake support accounts lure staff into chats, then to credential pages.
Harmful content for minors
Schools block it because open channels and groups can expose students to adult, violent or extremist material.
Unrecorded business chat
Regulated firms cannot archive Telegram chats, so business messages there create a records gap.
Why a DNS block alone does not stop Telegram
Most chat apps die when their domains stop resolving. Telegram is built to survive network blocks, so it needs controls at three levels.
DNS and URL filtering
- Stops the website, web client and link domains.
- Stops the apps finding servers by name.
- Does not stop apps that already know server IP addresses.
IP ranges and app control
- Firewall rules for Telegram's published ranges.
- Application signatures that match the protocol.
- Does not stop traffic sent through a proxy.
Proxies, VPNs and devices
- Block proxy and VPN categories and signatures.
- Block the apps on managed devices.
- Covers what the network cannot see.
Built-in proxy support is the reason Telegram blocks often fail. A user can paste a proxy link and the app routes around your firewall. Only blocking proxy and VPN traffic, plus the app on managed devices, closes it.
Official Telegram domains
Block each with all subdomains. These are the official, well-known domains; Telegram adds and moves hosts, so confirm against your logs and lean on the category for the rest.
| Domain | Purpose | Notes for admins |
|---|---|---|
telegram.org | Main site, downloads, web client (web.telegram.org), developer pages | Includes api.telegram.org, the bot interface. Highest priority on servers. |
t.me | Short links to users, channels, groups and proxy settings | Proxy share links use this format too, so blocking it removes one easy bypass in browsers. |
telegram.me | Alternative link domain | In 2026 t.me was put on hold at its registry and links moved here. Block both. |
telesco.pe | Video message hosting | Low traffic, but part of the official set. |
telegra.ph | Telegram's anonymous publishing tool | Often abused to host phishing pages. Many security teams block it everywhere. |
Unknown host in a log? The domain category lookup shows whether it belongs in the Email and Messaging category.
Do not block whole cloud or CDN providers to catch Telegram. Its web assets and some third-party Telegram tools sit on shared infrastructure, and a broad block will break unrelated business services. Match the official domains and ranges only.
The IP layer
Telegram publishes its own list of IP ranges in its developer documentation, and routes them from its own autonomous systems. Use that list, not copies from forums, which are often out of date.
| Item | What to do | How often |
|---|---|---|
| Published IP ranges | Load into a firewall address group named for Telegram and deny it outbound. | Refresh monthly or on change |
| Autonomous systems | If your firewall supports ASN objects, match Telegram's ASNs (for example AS62041 and AS59930). Check current routing data first. | Review quarterly |
| IPv6 | Telegram has IPv6 ranges too. Block them, or the app may simply switch to IPv6. | With the IPv4 refresh |
The Telegram blocking runbook
Work through the phases in order. Each phase is useful alone, but the block only holds when all of them are in place. Start with servers, because a Telegram connection from a server is far more likely to mean compromise than a distracted user.
Servers first
- Deny api.telegram.org and the IP ranges from all server segments.
- Alert on any attempt.
- Investigate hits as a possible compromise.
Names
- Block Email and Messaging, or the five domains, in DNS and web filter.
- Force DNS to your resolver.
- Block DNS over TLS on port 853.
Addresses
- Deny Telegram IP ranges outbound for user segments.
- Add the application signature to app control.
- Block QUIC on UDP 443.
Escape routes
- Block VPN / Proxy / Anonymizers.
- Block generic SOCKS and unknown encrypted protocols outbound where your policy allows.
- Restrict outbound ports to what you need.
Endpoints
- Block the desktop app with application control.
- Block the mobile app through MDM.
- Use endpoint web filtering off network.
Verify
- Run the tests below.
- Review logs weekly for the first month.
- Refresh IP ranges on a schedule.
Step-by-step by platform
Open the platform you use. Each panel lists what to configure; exact menu names change between versions.
Next-generation firewall (vendor-neutral)
- Create an address group from Telegram's published IPv4 and IPv6 ranges.
- Add an outbound deny rule for that group above your general internet rule.
- Add the Telegram application signature to an application control block rule.
- Add the messaging and proxy categories to your URL filter profile.
- Block QUIC so TLS server names are visible.
- Log every hit and send server-segment hits to your SIEM as alerts.
Most next-generation firewalls ship Telegram application signatures and a messaging category. Use both, and feed the IP ranges in as an external dynamic list where your firewall supports one.
DNS filter or router
- Block the Email and Messaging category or the five domains with subdomains.
- Hand out your resolver through DHCP and redirect any other port 53 traffic to it.
- Drop outbound DNS over TLS and block known DoH endpoints.
- On a home-style router, add the domains to the blocked sites list and, if supported, add an IP block for the published ranges.
DNS alone stops the website and many app connections, but read the section above on why the IP layer is still needed.
Microsoft Intune
- Use Intune to deploy your endpoint web filter policy that blocks the messaging category for the device groups in scope.
- Add the domains (telegram.org, t.me, telegram.me, telesco.pe, telegra.ph) and IP ranges to the policy's block list.
- Make sure the policy applies in every browser and app, not only the default browser.
- Block the Telegram Desktop executable and Store app with an application control policy.
Google Admin (Chrome and Chromebooks)
- Add the five domains to Chrome URL blocking for the right organisational units.
- Block the Telegram Android app on managed Chromebooks.
- Allow only approved Chrome extensions, so proxy and VPN extensions cannot be added.
MDM for iOS and Android
- Block or hide the app on supervised iOS devices through a restrictions profile.
- Leave Telegram off the managed Google Play allowlist on Android Enterprise devices.
- Push a device-wide filter or DNS profile so the rules apply on mobile data.
- Prevent users adding VPN profiles or changing private DNS.
Desktop and mobile apps vs the web client
The web client is the easy part. The installed apps are where Telegram's resilience shows, so put most of your effort there.
Web client
- Runs at web.telegram.org in any browser.
- Stopped by blocking telegram.org with subdomains.
- Shows your block page, which helps users understand the rule.
- Covered off network by an endpoint web filter or Chrome URL policy.
Desktop and mobile apps
- Can connect to known server IPs without DNS.
- Support proxies inside the app settings.
- Portable desktop builds run without an installer, so use allowlist-style application control.
- Phones on mobile data ignore your network entirely.
When to allow Telegram, and how to do it safely
Some teams have a real reason to use Telegram. A blanket block with no exception process tends to push them onto personal phones, where you have no visibility at all.
Threat intelligence analysts
Analysts watch public channels for leaked data and attack chatter. Give them an isolated analysis machine or a remote browser, never their main workstation.
Regional customer contact
In some markets customers expect to reach businesses on Telegram. Route that through a managed business messaging platform with archiving, not personal accounts.
Journalism and research
Newsrooms and researchers follow channels as sources. Use a separate network segment with logging and keep downloads sandboxed.
Approved bot integrations
A monitoring or alerting system may post to a Telegram bot. Allow api.telegram.org only from that one host, and alert on anything else.
Whatever the exception, scope it to a named directory group or a single host, give it an expiry date and review it each quarter. Exceptions that never expire become the next gap in your policy.
Signs that Telegram is already in use on your network
- DNS queries for telegram.org, t.me or telegram.me from devices that should not need them.
- Outbound connections to Telegram's published IP ranges, especially from servers or kiosks.
- Application control logs showing the Telegram signature on unexpected segments.
- Long-lived encrypted sessions to unknown hosts on unusual ports, which can point to an in-app proxy.
- Telegram Desktop or portable executables found by your endpoint inventory.
Bypass matrix
Map each bypass to the control that closes it. If a row has no control in your environment, that is your gap.
| Bypass | How it gets around you | Control that closes it |
|---|---|---|
| In-app proxy | The app sends traffic through a proxy server you do not know. | Block VPN / Proxy / Anonymizers, block t.me proxy links, restrict outbound ports, block the app on endpoints. |
| Hardcoded IPs | The app skips DNS and connects directly. | IP range deny rule and application signature. |
| VPN apps | All traffic leaves in a tunnel. | VPN category and signatures; block installs with MDM and application control. |
| Encrypted DNS | The browser or OS resolves names elsewhere. | Browser policy for system DNS, block port 853 and known DoH endpoints. |
| Portable desktop app | No installer, so install blocks miss it. | Application control based on publisher or hash. |
| Mobile data or hotspot | Traffic never touches your network. | MDM on owned devices; policy for personal devices. |
How to test the block
Test from a standard user device and from a server in a normal segment. On the client, a few commands confirm each layer.
nslookup web.telegram.org
nslookup api.telegram.org
# Layer 2: a direct connection to a published Telegram address should time out
Test-NetConnection <telegram-ip> -Port 443
# Server segment: this should fail and raise an alert
curl -sI https://api.telegram.org
- Open web.telegram.org in Chrome, Edge and Firefox: the block page appears.
- Launch the desktop app as a standard user: application control stops it.
- On a test phone on Wi-Fi with mobile data off, open the app: it stays on "Connecting".
- Add a test proxy in the app: the connection still fails.
- Try a free VPN app: it cannot connect.
- Open a t.me and a telegram.me link from an email: both show the block page instead of opening the app.
- Repeat the client tests on IPv6 if your network offers it, since a missing IPv6 rule is a common gap.
- Check that each attempt appears in logs with a category or application name, and that server hits create alerts.
Category-based blocking with our database
Telegram's own domains are few. The ecosystem around it is not: viewer sites, channel indexes, mirrors, proxy lists and lookalike phishing pages appear daily. A category database labels them as they arrive.
Email and Messaging
Telegram, its web client and other chat services, including new clients and viewers.
VPN / Proxy / Anonymizers
Proxy services, VPN sites and anonymizers. The category that keeps Telegram blocked.
Malware / Phishing / Suspicious
Lookalike login pages and malware hosts. Read about our phishing and malware domain feed.
Security vendors license the database to power their own filtering, delivered as files with a lookup API.
Licensed exports include DNS RPZ and firewall external dynamic lists; see blocklist formats. Security product teams can also read web filtering for cybersecurity vendors.
Related guides: how to block WhatsApp Web and how to block Steam at work.
Telegram blocking FAQ
Why does Telegram still work after I block telegram.org in DNS?
Telegram apps can reach their servers by IP address without a DNS lookup, and they support proxies built into the app. Add a firewall rule for Telegram's published IP ranges and an application control rule, not only a DNS block.
Where do I find Telegram's IP ranges?
Telegram publishes its own list of IP ranges in its developer documentation, and the ranges are announced by Telegram's autonomous systems. Load the current list into a firewall address group and refresh it on a schedule.
Should servers ever be allowed to reach api.telegram.org?
Rarely. api.telegram.org serves the bot interface, which attackers use for command and control and data theft. Unless a known integration needs it, block it from servers and alert on attempts.
Can I block Telegram channels but allow the app?
Not reliably. Traffic inside the app is encrypted and multiplexed, so network tools cannot tell a channel from a private chat. You can block t.me and telegram.me links in browsers, but that does not stop channels inside the app.
Do I need to block both t.me and telegram.me?
Yes. Both are official link domains. In 2026 t.me was placed on hold at its registry and Telegram pointed links to telegram.me, which shows why both belong on the list.
Which category covers Telegram?
Email and Messaging covers Telegram and other chat apps. Block VPN / Proxy / Anonymizers too, because Telegram proxies and VPNs are the usual way around a block.
Building a security product that blocks messaging?
License 120 million categorized domains, updated daily, to run inside your own firewall, gateway or DNS filter. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Telegram is a trademark of Telegram Group Inc. Microsoft and Intune are trademarks of Microsoft Corporation; Google, Chrome and Android of Google LLC.
They are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.