How to block Tumblr on your network
Tumblr is a blogging and social platform where every user's blog gets its own address. That is exactly why a simple rule on the main website often leaves most of Tumblr reachable.
This guide is for school, business and family network admins who want the whole platform blocked, including blogs, images and the app, without breaking anything else.
Why organisations block Tumblr
Tumblr has a loyal user base in fandom, art and writing communities. Admins block it mostly because of what can appear on a public dashboard, and because content is hard to filter blog by blog.
Mature content
The platform's rules on mature content have changed more than once. Some content allowed on the platform is not suitable for school networks.
Sensitive topics
Communities form around hard subjects. Schools worry about young people finding harmful content on self-harm or eating disorders without support.
Contact with strangers
Messaging and asks let anyone reach a blog's owner. Youth organisations treat that as a risk on networks used by minors.
Time on task
Reblog chains and endless dashboards pull attention away from work and lessons.
Policy consistency
If other social platforms are blocked, Tumblr is the next place students look.
Copyright and reposts
Reposted media is common. Some businesses prefer to keep it off company networks and devices.
Arts and media courses. Some teachers use Tumblr for art or writing research. If that applies, plan a scheduled or group exception instead of a site-wide allow.
Tumblr domains to block
The key is a wildcard or domain-suffix rule on tumblr.com. That one rule covers the main site, every blog subdomain and the media hosts.
| Domain or host | What it serves | Action |
|---|---|---|
tumblr.com and *.tumblr.com | Main site, dashboard, login, app API, every blog subdomain and the numbered media hosts such as 64.media.tumblr.com. | Block |
| Tumblr short link and redirect hosts | Tumblr has used separate short domains for links shared from the platform. Add any you see in your logs. | Check logs |
| Blogs on custom domains | Blogs shown on their owner's own domain name. These do not match a tumblr.com rule. | Category rule |
| Shared CDN and cloud domains | Large providers host many unrelated services on the same domains. | Do not block |
Domain lists change as platforms move hosts, so treat this as a starting point. To see how any host is labelled before you add it, use the domain category lookup. Tumblr usually falls under Blogs/Personal Sites or Social Networking.
Hosts files and basic routers: they often do not support wildcards. Adding tumblr.com alone may block only the main page, leaving every blog subdomain open. Use a DNS filter or firewall that matches domain suffixes.
Methods that work
Start at the network and move inwards. The first two layers are enough for most offices; schools with managed devices should use all of them, on every network.
DNS and category filter
- Point every SSID and VLAN at your filtering resolver through DHCP.
- Add tumblr.com as a wildcard or suffix block.
- Block Blogs/Personal Sites or Social Networking for groups where your policy says so.
- Redirect port 53 to your resolver; block DNS over TLS on port 853.
- A managed DNS filter handles this if you run no resolver of your own.
Firewall
- Add *.tumblr.com to a URL filter block profile.
- Block the Tumblr application signature where your firewall has one.
- Block QUIC (UDP 443) on filtered segments so server names are visible.
- Use TLS inspection only where policy allows it; exclude sensitive categories.
Browser policy
- Google Admin: add tumblr.com to the URL block list; it matches subdomains.
- Microsoft Intune: push an Edge URL block list for tumblr.com.
- Disable browser DNS over HTTPS by policy.
- Allow only approved extensions to stop proxy add-ons.
MDM
- Block or remove the Tumblr app on supervised iOS and Android Enterprise devices.
- Add tumblr.com to the device web content filter.
- Push a DNS profile so rules apply on mobile data.
- Prevent VPN profile installs and DNS changes.
Home router
- Check whether the router's block list supports wildcards.
- If not, set the router's DNS to a filtering resolver and block there.
- Use a separate profile for children's devices if available.
Search settings
- Enforce SafeSearch so image searches do not surface Tumblr media.
- See the SafeSearch enforcement guide.
- Pair with the category rule for custom-domain blogs.
App, website and custom-domain blogs
Tumblr reaches users three ways. Each one responds to a different control, so a plan that covers only one of them leaves visible gaps.
Tumblr app
- Blocked on your Wi-Fi by the tumblr.com wildcard.
- Works on mobile data unless the device is managed.
- MDM can block install on owned devices.
tumblr.com in a browser
- Blocked on your network by DNS or firewall.
- Blocked anywhere on managed browsers via URL policy.
- Embedded posts on other sites show empty frames.
Blogs on own domains
- Not covered by the tumblr.com rule.
- Media from Tumblr hosts still fails to load.
- Covered by the Blogs/Personal Sites category.
Closing the bypass routes
These are the workarounds that appear most often once Tumblr is blocked, and the control for each.
VPN apps
Block the VPN / Proxy / Anonymizers category and VPN signatures; stop VPN profile installs through MDM.
Proxy and viewer sites
Sites that show Tumblr blogs through another domain. See how to block proxy sites.
Encrypted DNS
Disable browser DNS over HTTPS, block port 853, and enforce private DNS on managed Android devices.
Custom-domain blogs
Shared by direct link. The category rule catches many; check any reported address in the lookup tool.
Short links
Links shared in chats can pass through shorteners. Review the URL Shorteners category for student networks.
Hotspots
A phone sharing mobile data is outside any network rule; a phone policy covers it.
Is there a middle ground?
Not every organisation wants an all-or-nothing rule. A network filter sees domains, not individual posts, so the middle ground is about who and when rather than which blogs.
By group
- Block for students and general staff.
- Allow for a named group, such as the art department or a social media team.
- Review the group once a term or quarter.
By time
- Block during lessons or working hours.
- Allow at lunch or after hours for adult networks.
- Keep VPN and proxy categories blocked at all times.
By device
- Allow on teacher laptops only, never on shared student devices.
- Keep the app blocked on all tablets.
- Use a separate profile; see filtering profiles and networks.
Single-blog allows rarely work well. Allowing one blog subdomain may still pull in media, embeds and links to blogs you have not reviewed. If a teacher needs one blog, a time-limited group exception is easier to manage.
Reading Tumblr in your logs
Tumblr traffic has a recognisable shape. Knowing it helps you tell real use from side effects.
Many subdomains at once
A single dashboard visit can touch dozens of blog and media subdomains. Count by base domain, not by host, to see real usage.
Media without a blog visit
Images from Tumblr media hosts can be embedded on other sites and in search results. Blocked media hits do not always mean someone opened Tumblr.
Background refresh
The app can refresh while a phone sits in a bag. Small overnight bursts are usually that.
Redirect chains
Links shared from Tumblr can pass through redirect hosts before reaching their target. Blocked redirects can break outbound links that teachers share.
VPN attempts
Blocked VPN category hits that start right after a social block are a sign of workarounds. Handle them under your acceptable use policy.
Reporting
Monthly summaries by category show whether the block holds. See monthly filtering reports.
Test the block
Use a device set up like your users' devices, with mobile data off. You do not need to browse blogs to test; DNS queries and the app's behaviour are enough.
- Run
nslookup www.tumblr.comandnslookup staff.tumblr.comfrom a filtered client; both should be blocked. - Run
nslookup 64.media.tumblr.comto confirm media hosts are covered by the wildcard. - Open tumblr.com in two browsers and confirm your block page.
- Open the Tumblr app; the dashboard should fail to load.
- Try a free VPN on the test device and confirm it cannot connect.
- On a managed device on mobile data, confirm MDM still blocks the app.
- Check your logs for the blocked events and the categories they carry.
Troubleshooting
When users say Tumblr still works, the cause is usually one of these. Check the device and the rule type before adding new entries, because most leaks come from how the rule matches, not from a missing domain.
| Symptom | Cause | Fix |
|---|---|---|
| Main page blocked, blogs open | Rule matches only the exact name, not subdomains. | Use a wildcard or suffix rule on tumblr.com. |
| Blog pages load without images | Media hosts blocked, page host not. | Check the blog's address; it may be a custom domain. |
| Works in one browser only | That browser uses its own encrypted DNS. | Disable browser DNS over HTTPS by policy. |
| App works on one phone | VPN, private DNS or the phone is on mobile data. | Check the phone's network settings and MDM group. |
| Hosts file block has no effect on blogs | Hosts files do not support wildcards. | Move the rule to a DNS filter or firewall. |
Recommended settings by audience
Starting points; adapt them to your own policy and local rules. Whatever you choose, keep the VPN and proxy categories blocked on every network used by minors.
Primary school
Block tumblr.com and the Blogs/Personal Sites category everywhere; block the app on all tablets.
Secondary school
Block for students; consider a scheduled exception for art or media classes on teacher devices.
Office
Block for most groups, or allow at break times with a schedule. See time schedules.
Family home
Block on children's profiles; talk with older children about why.
Library
Block on the children's network; follow local policy for adults.
Guest Wi-Fi
Usually allowed, with adult, malware and phishing categories blocked.
Policy checklist before you switch it on
A few decisions made in advance stop the rule from being reversed after the first complaint.
- Is the rule about Tumblr only, or about blogs and social sites in general? If general, lead with the category rule.
- Which networks are covered: student, staff, guest, BYOD? Write each one down.
- Which managed devices get the MDM app block, and does it apply off-site?
- Who approves exceptions, and how long do they last before review?
- Does anyone need Tumblr for work, such as a communications or art team?
- How are repeated VPN attempts handled: technical block only, or a conversation too?
- Who receives the monthly category report, and who acts on it?
- When is the rule reviewed next? Platforms and their rules change, so once a year is a sensible minimum.
Tell people what changed
A short note prevents a wave of help desk tickets and reminds everyone that filtering is one layer of a wider approach. Send it a few days before the change.
Students
School Wi-Fi is for learning, blogs and social sites are blocked during the day, and VPN use breaks the rules. Tell them who to talk to if something online upsets them.
Parents
The school blocks Tumblr on its own Wi-Fi and devices, not on personal phones using mobile data.
Art and media teachers
Explain how to request a time-limited exception for coursework research.
Safeguarding lead
Category filtering blocks types of sites. Concerns about a particular young person go through your safeguarding process.
Help desk
Give the team one standard reply for "Tumblr is not loading" tickets, with a link to the exception process, so every answer is the same.
Managers and staff
State which groups keep access and why. Remind staff that school or company accounts, not personal ones, are used for any official posting.
Keep the note short and avoid listing workarounds or alternative sites. Naming them only tells curious users where to look next.
Keep the block current with category data
The tumblr.com wildcard covers the platform. It does not cover custom-domain blogs, mirrors and viewers, which is where category data takes over.
Each new domain is checked again after a week and a month, because blogs often start empty and fill up later. Filter vendors and MSPs license the web filtering database to run these categories inside their products. Related guides: how to block Reddit and how to block Pinterest.
Tumblr blocking FAQ
Why does blocking www.tumblr.com not block Tumblr blogs?
Each Tumblr blog has its own subdomain, such as name.tumblr.com, and images come from separate media subdomains. A rule on www.tumblr.com alone misses them. Block tumblr.com with all subdomains, using a filter that supports wildcard or domain-suffix rules.
Can I block Tumblr with a hosts file?
Not well. Hosts files do not support wildcards, so you would need a line for every blog and media host. A DNS filter or firewall with domain-suffix matching blocks tumblr.com and every subdomain in one rule.
Do Tumblr blogs on custom domains get blocked too?
Not by a tumblr.com rule. A blog can be shown on its owner's own domain. The page may still load media from Tumblr hosts, which a wildcard block stops, but the address itself needs a category rule to be covered reliably.
Which category is Tumblr in?
Tumblr is usually classed as Blogs/Personal Sites or Social Networking, and individual blogs can carry other labels depending on their content. Check any domain in the domain lookup tool to see its categories.
Can I block Tumblr on a school iPad on mobile data?
Yes, if the iPad is managed. Block the Tumblr app with MDM, add tumblr.com to the device web content filter and stop VPN profiles. Personal devices on mobile data are outside any network rule.
How does a category database help block Tumblr?
Custom-domain blogs, mirrors and viewer sites appear under new names. A Blogs/Personal Sites or Social Networking category refreshed daily catches many of them without manual list edits.
Category data for blog and social rules
For filter vendors, MSPs and edtech makers: 120 million domains in 59 categories, delivered as files that run inside your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
License the databaseTumblr is a trademark of Tumblr, Inc. Google, Chrome and Android are trademarks of Google LLC; Apple, iPad and iOS of Apple Inc. (iOS used under licence); Microsoft, Edge and Intune of Microsoft Corporation; other names belong to their respective owners.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.