Why organisations block or restrict YouTube
YouTube is one of the largest sources of traffic on most networks. The reasons to control it are practical, and they decide which path fits.
Bandwidth
High definition video on many devices at once can saturate a school or branch office link, slowing cloud apps for everyone.
Mature content
Schools and libraries need to limit videos that are unsuitable for minors, which is what Restricted Mode is built for.
Focus
Recommendations and autoplay pull people from task to task. Shift based workplaces often block it outright.
Learning value
Lessons, tutorials and vendor training live on YouTube. That is why so many policies restrict rather than block.
Restricted Mode is a filter built into YouTube. It works well as a baseline, but it is not perfect, so many schools also block specific channels or videos and keep a category filter for the rest of the web.
Whichever path you choose, write it into your acceptable use policy with the user groups it applies to. A written rule makes exception requests easier to judge and helps the next administrator understand why YouTube behaves the way it does.
Verified YouTube domains
These hostnames and domains are used by YouTube on the web, in apps and in embeds. Google changes its delivery setup over time, so pair the list with a category based rule.
| Domain or hostname | Used for | Full block | Restricted Mode |
|---|---|---|---|
youtube.com | Website, mobile site, music and studio pages | Block with subdomains | Remap www and m only |
youtu.be | Short share links | Block | Leave alone |
ytimg.com | Thumbnails and page images | Block | Leave alone |
googlevideo.com | The video streams themselves | Block, this stops playback | Leave alone |
youtube-nocookie.com | Privacy enhanced embeds on other sites | Block | Remap www |
youtubei.googleapis.com | App and player API | Block this hostname only | Remap |
youtube.googleapis.com | Older API endpoint used by some clients | Block this hostname only | Remap |
youtubekids.com | YouTube Kids | Your choice | Not affected |
Never block googleapis.com as a whole. Gmail, Drive, Maps, Classroom and many third party apps depend on it. Only block or remap the YouTube hostnames listed above.
Look up any hostname from your firewall logs in our domain lookup tool to see its categories before adding it to a rule.
Path B: enforce YouTube Restricted Mode
There are two strengths of Restricted Mode, plus the option of leaving it off. Pick one per user group, then choose an enforcement method below.
Moderate
- Hides a smaller set of mature videos.
- Comments remain hidden.
- Common for staff and older students.
Strict
- Hides a larger set of videos.
- Comments are hidden.
- Common for primary and middle schools.
Strict plus approved videos
- Workspace users only see allowed or approved content.
- Teachers or approvers can approve specific videos.
- Set in the Google Admin console for the account.
Method 1: DNS remapping for the whole network
Your resolver answers the YouTube hostnames with a CNAME to Google's restricted endpoint. Every device that uses your DNS gets Restricted Mode, signed in or not.
Because the change happens in DNS, it also covers smart TVs, games consoles and visitors' phones on your Wi-Fi, which browser policies never reach. Most DNS filters have a single switch for this. On a self hosted resolver, create the records as local overrides. Check the current hostnames in Google's admin help before rolling out, as they can change.
Know the limits before you rely on it
Method 2: managed browser policy
Google Admin console
- In Chrome settings for users and browsers, find the YouTube Restricted Mode setting under content.
- Choose moderate or strict for each organizational unit.
- Applies to Chrome on managed Chromebooks and enrolled browsers.
Intune for Edge and Chrome
- Use the settings catalog to set the force YouTube restrict policy for Edge and for Chrome.
- Scope to the right device or user groups.
- Covers browsers only, so combine with DNS for other apps.
Method 3: Google Workspace account settings
For signed in Workspace users, the Admin console has YouTube settings under additional Google services. You can set strict or moderate access per organizational unit, and allow staff to approve videos for students.
Method 4: proxy header injection
A web proxy or firewall with TLS inspection can add the YouTube-Restrict header with the value Strict or Moderate to YouTube requests. This suits networks that already inspect TLS for other reasons.
| Method | Covers guests | Covers off site | Covers mobile apps | Needs TLS inspection |
|---|---|---|---|---|
| DNS remapping | Yes | No | Yes, on your Wi-Fi | No |
| Browser policy | No | Yes | No | No |
| Workspace settings | No | Yes, when signed in | Yes, when signed in | No |
| Header injection | Yes | No | Partly | Yes |
Path A: block YouTube completely
A full block needs the domain set from the table, applied at the network and on managed devices. These are the methods, in the order most teams roll them out.
DNS filter
- Enable the Streaming Media category, or add youtube.com, youtu.be, ytimg.com, googlevideo.com and youtube-nocookie.com with subdomain matching.
- Add the two YouTube hostnames under googleapis.com as exact entries.
- Serve the resolver via DHCP on every network in scope.
Firewall
- Block the YouTube application or the streaming media URL category for in scope networks.
- Force DNS to your resolver and block DNS over TLS on port 853.
- Block QUIC on UDP 443, since YouTube relies heavily on it and it hides traffic from older inspection engines.
Router
- Add the domains to the router's blocked sites list, or use keyword blocking for "youtube" and "googlevideo".
- Apply to all clients or on a schedule.
- Expect bypass via VPN or custom DNS.
Intune
- A settings catalog policy for Edge and Chrome with the YouTube domains on the URL block list.
- Scope it to the device groups in the policy.
- Configure every browser you allow, since the block only covers browsers you manage.
Google Admin
- Add the YouTube domains to Blocked URLs for the organizational unit.
- Block the YouTube Android app under Apps and extensions.
- In Workspace settings, you can also turn off YouTube for the account.
MDM
- Supervised Apple devices: hide or block the YouTube app and add domains to the web content filter.
- Android Enterprise: YouTube is often preinstalled; disable it as a system app on fully managed devices where your MDM allows.
- Block VPN apps on owned phones if required.
Middle ground options between block and Restricted Mode
Some networks need more control than Restricted Mode but cannot lose YouTube entirely. These options sit between the two paths and can be combined.
Bandwidth limits
- Cap the YouTube application to a share of the link with firewall traffic shaping.
- Video drops to lower resolution instead of failing.
- Good for branch offices where training video is needed but not in HD.
Approved videos only
- Workspace accounts in strict mode see approved content only.
- Teachers approve the videos they need for lessons.
- Students cannot browse the wider catalogue.
Scheduled access
- Full block during lessons or shifts, Restricted Mode at lunch.
- Set with scheduled rules on the DNS filter or firewall.
- Document the schedule so support staff can explain it.
Different user groups often land on different options. A common school pattern is approved videos only for younger pupils, strict Restricted Mode for older students, moderate for staff, and a full block on the guest network.
YouTube app vs browser
The YouTube app on phones, smart TVs and tablets behaves differently from youtube.com in a browser. Plan for each surface you need to cover.
| Surface | Full block behaviour | Restricted Mode behaviour | Best control |
|---|---|---|---|
| Browser on laptop | Block page or connection error | DNS remap or browser policy both work | DNS filter plus browser policy |
| Mobile app on Wi-Fi | Spinning loader, no playback | DNS remap applies to the app | DNS filter plus firewall app control |
| Mobile app on cellular | Network rules do not apply | Only account settings apply | MDM, or Workspace settings for signed in users |
| Smart TVs and meeting room screens | Blocked by DNS and firewall | DNS remap applies | Separate VLAN with its own policy |
| Embedded videos | Empty player frame | Restricted where nocookie host is remapped | Include youtube-nocookie.com |
VPN, proxy and alternative front ends
Students and staff who want around a YouTube block tend to try three things: a VPN, a web proxy, or a third party front end that replays YouTube video. Each has a counter.
- VPN apps and services. Block the VPN / Proxy / Anonymizers category on DNS and firewall, use VPN application detection, and block VPN apps through MDM.
- Web proxies. These appear constantly under new names. A daily refreshed category is the only practical defence, since lists go stale within days.
- Alternative front ends. Some sites relay YouTube content through their own servers. They are usually categorized as proxies or streaming, so category blocks catch most of them.
- Encrypted DNS. Disable secure DNS in managed Chrome and Edge, return no result for use-application-dns.net for Firefox, and allow DNS only to your resolver.
- Private Relay. Return no result for mask.icloud.com and mask-h2.icloud.com so Apple devices fall back to your network's DNS.
See our VPN and proxy category for what it covers. Gaming streams are a related gap: if YouTube is blocked, students often switch to live streaming platforms, so consider our guide to blocking Twitch at the same time.
How to test your YouTube policy
Testing differs by path. For a full block you check that nothing loads. For Restricted Mode you check that YouTube loads with the filter switched on and locked.
Full block tests
- Run nslookup for www.youtube.com and a googlevideo.com host: expect a block answer.
- Open youtube.com in a private window: block page or refused.
- Open a news article with an embedded video: empty frame.
- Open the app on Wi-Fi and on mobile data on a managed phone.
- Set a public resolver on a test laptop and retry.
Restricted Mode tests
- Run nslookup for www.youtube.com: the answer should be a CNAME to the restrict hostname.
- Open YouTube signed out, open the account menu: Restricted Mode shows as on and locked.
- Open a video with comments: comments are hidden.
- Test the app on Wi-Fi the same way.
- Test a signed in student account off site to confirm the Workspace setting.
Clear DNS caches between tests with ipconfig /flushdns on Windows, or by toggling Wi-Fi on phones. Browsers keep their own DNS cache too, so close and reopen them.
Category based blocking for video and streaming
YouTube is one site. Streaming Media is thousands of them, with new video hosts, mirrors and relay sites registered every day. Category data keeps a video policy complete without manual list work.
YouTube sits in our Streaming Media category, with ranked secondary categories for its community features. Many schools pair a Streaming Media policy with blocks on Social Networking. Our knowledge base article on streaming classification explains how video sites are told apart.
Build it into your product
Firewall, secure web gateway, DNS filter and edtech vendors license the database as files that run in their own systems, with a lookup API included.
Plan the K-12 policy
See K-12 school web filtering for how districts combine Restricted Mode with category filtering across Chromebooks and campus networks.
YouTube blocking FAQ
Should I block YouTube or use Restricted Mode?
Schools and many workplaces use Restricted Mode, because YouTube hosts a lot of teaching and training video. A full block suits networks where video is not needed at all, such as point of sale, kiosks or bandwidth constrained sites.
How do I force YouTube Restricted Mode for the whole network?
Point the YouTube hostnames www.youtube.com, m.youtube.com, youtubei.googleapis.com, youtube.googleapis.com and www.youtube-nocookie.com to restrict.youtube.com or restrictmoderate.youtube.com in your DNS. On managed Chrome and Edge you can also enforce it with browser policy.
Does blocking youtube.com break Google services?
Blocking youtube.com, youtu.be, ytimg.com and googlevideo.com does not affect Gmail, Drive or Search. Do not block googleapis.com as a whole, because many Google services depend on it. Block only the specific YouTube hostnames under it.
Why do embedded YouTube videos still play?
Embeds often load from youtube-nocookie.com and stream from googlevideo.com. Add both to a full block, or include youtube-nocookie.com in your Restricted Mode DNS entries.
Which category is YouTube in?
YouTube is in Streaming Media in our web filtering database, with secondary categories describing its community features.
Can students turn Restricted Mode off?
Not when it is enforced by DNS, browser policy or Workspace settings. The toggle in the account menu shows as locked. If a student can switch it off, the device is not using your resolver or policy, which is worth investigating.
Is Restricted Mode enough for CIPA compliance?
Restricted Mode is a useful layer for video, but CIPA asks for a technology protection measure across internet access on computers used by minors. Schools combine it with a category filter for the rest of the web and check the current FCC guidance.
Does Restricted Mode affect YouTube Music or YouTube Kids?
YouTube Kids is a separate service with its own settings and domain. Check the current Google admin help for how Restricted Mode applies to music content, because behaviour has changed over time.
Category data for video and streaming policies
License 120 million categorized domains with daily updates for your filter, firewall or MSP platform. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
YouTube, YouTube Kids, Google, Google Workspace, Chrome, Chromebook and Gmail are trademarks of Google LLC. Microsoft, Intune and Edge are trademarks of Microsoft Corporation. Apple and iCloud are trademarks of Apple Inc. Firefox is a trademark of the Mozilla Foundation.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.