Why organisations block TikTok
TikTok is one of the most requested blocks we hear about from administrators. The reasons differ by sector, and knowing yours helps you pick the right scope: a full block, a block on work devices only, or a time window.
Data and device policy
Several governments, including the US federal government, the European Commission, Canada and the UK, banned TikTok on government issued devices in late 2022 and 2023. Many contractors and regulated firms followed with their own device rules.
Bandwidth
Short video autoplays continuously. On a shared guest network or a school link, a few dozen active users can take a noticeable share of capacity at peak times.
Classroom focus
Schools block it during lessons because the endless feed competes directly with teaching. Many also cite age rules, since the service sets a minimum age of 13 in most countries.
Workplace productivity
Some businesses block it on staff Wi-Fi while leaving it open on a separate guest network. Others allow it only for marketing teams who run a brand account.
Write the policy first. Decide who is in scope, which devices and which networks, then pick methods. A block without a written reason tends to get quietly removed after the first complaint.
Verified TikTok domains to block
These are well known domains used by the TikTok website and app. TikTok, like every large platform, adds and retires hostnames, so treat this as a starting point and not a complete list.
| Domain | What it serves | Block it? |
|---|---|---|
tiktok.com | Main website, web player, login and most first party pages | Yes, including all subdomains |
tiktokcdn.com | Video files, thumbnails and static assets | Yes, without it a block on tiktok.com leaks media |
tiktokcdn-eu.com | Regional content delivery used for European traffic | Yes, needed for users in or routed through Europe |
tiktokv.com | API endpoints used by the mobile app | Yes, this is what stops the app feed |
musical.ly | Legacy domain from the app TikTok absorbed, still seen in some API traffic | Yes, low risk |
byteoversea.com | Parent company infrastructure for services outside China | Yes, but check for other ByteDance apps you want to keep |
ibyteimg.com | Image delivery shared with other ByteDance products | Usually, same caveat as above |
Four mistakes that make TikTok blocks fail
- Blocking only www.tiktok.com instead of the whole domain and its subdomains.
- Leaving the content delivery and API domains open, so the app keeps loading.
- Applying the block on the staff network but forgetting the guest or student SSID.
- Testing once from an admin laptop and never again from a phone.
Always block at the registrable domain level so that every subdomain is covered. Entering only www.tiktok.com is the most common reason a TikTok block fails.
To confirm how any hostname from your own logs is categorized, paste it into our domain category lookup tool. It shows the categories assigned to that domain, ranked by how much of the site they describe.
The seven day TikTok block rollout
Rolling out in stages avoids two problems: blocking something people need, and believing a block works when it does not. Each stage below has a clear exit condition before you move on.
Measure current TikTok use
Before blocking, look at what is already happening. Your DNS resolver or firewall logs show how many devices query TikTok domains and when.
- Search DNS logs for the domains in the table above.
- Note which VLANs or SSIDs produce the traffic: staff, students, guests, IoT.
- Identify any team with a business reason, such as marketing or communications.
Choose the scope and the exceptions
Pick between a TikTok only block and a broader Social Networking category block. Agree exceptions in writing.
- Full block on all networks, or staff and student networks only.
- Named exception group for the social media team.
- Optional time windows, for example lessons or core hours.
Block the domain family at your resolver
DNS filtering is the fastest win because it covers every device on the network, including ones you do not manage. Add the domains with subdomain matching, or enable the category.
- Point DHCP at your filtering resolver for every network in scope.
- Return a block page or a null answer for matched names.
- Keep logging on so you can see attempts after the change.
Close the DNS bypass routes
Users who change their DNS server skip a resolver block. The firewall closes that gap and adds application level detection.
- Allow outbound DNS on port 53 only from your own resolver.
- Block known public DNS over HTTPS endpoints, or use the firewall's encrypted DNS category.
- Enable the TikTok application signature or the Social Networking URL category.
- Block UDP 443 (QUIC) for in scope networks so traffic falls back to inspectable TCP.
Push device policies for laptops and Chromebooks
Laptops leave the building. A device policy keeps the block in place at home, in cafés and on hotel Wi-Fi.
- Windows: a URL blocklist for Edge and Chrome via Intune.
- Chromebooks: URL blocklist in the Google Admin console, plus the Android app block.
- Mac: a content filter profile from your MDM.
Remove or block the mobile app
On mobile data your network block does not apply at all. Only an MDM rule on the device helps there.
- Supervised iPhones and iPads: hide or block the TikTok app and add the domains to the web content filter.
- Android Enterprise: do not approve TikTok in managed Google Play, and block it in the work profile.
- Personal phones on guest Wi-Fi: network block only, communicated clearly.
Test from every device type and record results
Run the test checklist further down this page from a staff laptop, a student device, a guest phone and a remote laptop. Record what you saw, and repeat the check every quarter.
Method by method: where to block TikTok
Each enforcement point sees different traffic. Most organisations combine at least two of the methods below: one on the network and one on the device.
Home or small office router
Most routers have a website or keyword block list under parental controls or access control. Add each domain from the table.
- Good for a small shop or a single office.
- Many routers only match exact names, so add each domain separately.
- Weak against devices using their own DNS or a VPN.
DNS filter
A filtering resolver, hosted or on premise, blocks by name for every device that uses it. It is the simplest network wide method.
- Covers unmanaged and guest devices.
- Category blocking catches new TikTok domains automatically.
- Needs firewall rules so users cannot pick another resolver.
Next generation firewall
Firewalls combine URL categories with application signatures, which recognise TikTok traffic even when a new hostname appears.
- Inspects SNI and, with TLS inspection, full URLs.
- Can apply schedules and user groups.
- Only protects devices behind it.
Endpoint and MDM
Device policies follow the device anywhere. They are the only control that works on mobile data or home broadband.
- Intune for Windows.
- Google Admin for Chromebooks.
- Apple and Android MDM for phones and tablets.
Microsoft Intune and Google Admin settings
Managed laptops need their own policy. These are the settings admins most often use for TikTok, described in plain terms rather than menu by menu, because consoles move things around.
| Platform | Where the control lives | What to configure | Watch out for |
|---|---|---|---|
| Windows with Intune | Settings catalog policies for Edge and Chrome | A URL blocklist with the TikTok domains | Only covers the browsers you configure, not the desktop app |
| Chromebooks | Google Admin console, Chrome settings for users and browsers, URL blocking | Blocked URLs list with each TikTok domain | Also block the TikTok Android app under Apps and extensions if Play is enabled |
| Mac | Content filter or restrictions profile from your MDM | Denied URL list with the TikTok domains | Private Relay and VPN profiles can bypass network level rules |
App vs browser: why phones behave differently
The TikTok mobile app does not behave like a web page. It talks to API domains directly, caches video and retries in the background. That is why a block that works in a browser sometimes looks patchy in the app.
In a browser
- The user sees your block page, or a connection error with encrypted traffic.
- Browser DNS over HTTPS can skip your resolver unless disabled by policy.
- Blocking tiktok.com plus tiktokcdn.com is usually enough.
In the mobile app
- The app shows a "no network" message or an empty feed, never your block page.
- Cached videos may still play for a few minutes after the block starts.
- You need tiktokv.com and the infrastructure domains as well.
- On mobile data, only MDM controls apply.
VPN, proxy and private relay bypass
Determined users try to tunnel past filters. You cannot stop every method on unmanaged devices, but you can close the easy routes and spot the rest in your logs.
- Block the VPN / Proxy / Anonymizers category on DNS and firewall, which covers consumer VPN sites and many proxy services.
- Use the firewall's VPN application signatures for common protocols where your policy allows.
- Answer the domains mask.icloud.com and mask-h2.icloud.com with no result to signal that Apple's Private Relay is not available on your network.
- Return no result for use-application-dns.net so Firefox does not turn on encrypted DNS automatically.
- Disable secure DNS in Chrome and Edge through managed browser policy on owned devices.
- Prevent users from installing VPN apps and profiles on managed phones through MDM.
Our VPN and proxy category covers anonymizer services, web proxies and VPN providers, refreshed as new ones appear.
How to test that TikTok is really blocked
Test from each kind of device, not just your own admin laptop. Record the result, the date and the network, so you have evidence for audits and for the next admin.
| Test | How | Expected result |
|---|---|---|
| DNS answer | Run nslookup tiktok.com and nslookup api.tiktokv.com from a client | Block page address or no answer |
| Browser | Open tiktok.com in a private window after clearing the DNS cache | Block page or connection refused |
| Mobile app on Wi-Fi | Open the app, pull to refresh, try search | No new content loads |
| Mobile app on cellular | Same test on a managed phone with Wi-Fi off | App missing or blocked by MDM |
| Alternate DNS | Set a public resolver manually on a test device | DNS fails or TikTok is still blocked by the firewall |
| Remote laptop | Test from home broadband on a managed Windows or Chromebook device | Endpoint policy blocks the site |
| Embeds | Open a news page with an embedded TikTok video | Empty frame, rest of the page normal |
Category based blocking with our database
Hand built domain lists go stale. Category based blocking assigns TikTok and every similar service to a category, so new domains are covered as soon as they are categorized, without anyone editing a list.
TikTok and its delivery domains sit in our Social Networking category. Short video embedded on other sites is covered through the Streaming Media category, which many schools block alongside it. Domains can carry several categories, ranked, so you can decide how strict to be.
For firewall, DNS and MSP vendors
License the database to power category blocking inside your own product. It runs as downloadable files in your own systems, and a lookup API is included. See OEM licensing for embedded use.
For IT teams running their own stack
Licensed exports can include DNS RPZ zones, hosts files, Pi-hole style lists and firewall external dynamic lists. Our guide to blocklist formats explains which one fits which tool.
If you are deciding between resolver and proxy enforcement, read DNS filtering vs web filtering. MSPs managing many tenants will find planning notes on our MSP web filtering page. Blocking other short video and social apps next? The same approach works for blocking Instagram.
TikTok blocking FAQ
Is blocking tiktok.com enough to stop TikTok?
No. The app and the website load video, images and API calls from several other domains, such as tiktokcdn.com, tiktokv.com and ByteDance infrastructure domains. Block the whole domain family, or use a Social Networking category block that already includes them.
Why does TikTok still work on phones after I blocked it on the firewall?
The usual causes are mobile data instead of Wi-Fi, a VPN or private relay, encrypted DNS that skips your resolver, or QUIC traffic your firewall does not inspect. Phones you manage need an MDM rule as well as the network block.
Can I block TikTok but allow other social networks?
Yes. Keep the Social Networking category allowed and add the TikTok domain family as a specific block, or use your firewall's application signature for TikTok. A category database helps you see which domains belong to which service.
Will blocking TikTok break other websites?
Rarely. Some news and brand sites embed TikTok videos, and those embeds will show as empty boxes. The rest of the page keeps working.
Should I block ByteDance infrastructure domains too?
For a complete block, yes. Check first whether staff use other ByteDance apps for work, because some infrastructure domains are shared between products.
How do I keep a TikTok block up to date?
Domain lists change, so rely on a category feed that is refreshed daily and on application signatures from your firewall vendor, and review your DNS logs for new TikTok related hostnames every few months.
Build TikTok and social blocking into your product
120 million categorized domains, 59 categories and daily updates, delivered as files that run in your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
TikTok is a trademark of ByteDance Ltd. Microsoft and Intune are trademarks of Microsoft Corporation. Google, Chromebook and Google Play are trademarks of Google LLC. Apple, iPhone, iPad and iCloud are trademarks of Apple Inc. Firefox is a trademark of the Mozilla Foundation.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.