There is no single list of blocked domains that fits every network. A school, a dental practice, a hotel guest network and a mobile app all need different lists, deployed in a different order.
This page maps environments to category blocklists, then links to a detailed page for each list and to step by step blocking guides.
Who uses the network decides what belongs on the block list. Pick the environment closest to yours to see the lists people in that role usually deploy first.
Child safety rules and funding conditions drive the list. Bypass tools matter as much as content.
Security first, then acceptable use. Most firms block less content than schools but log more.
One baseline for every tenant, with per-client add-ons. Consistency saves ticket time.
Subscribers opt in to filtering tiers. The list must be broad, fast to load and easy to explain.
Venues want to avoid liability without fielding complaints. Short, defensible lists work best.
Parental control, browser and security apps ship lists inside a product. Coverage and update speed decide reviews.
This matrix sums up common practice. It is a starting point for your own policy, not a legal requirement, so check the rules that apply to your sector and country.
| Blocklist | K-12 school | Library | Office | MSP baseline | ISP family tier | Guest Wi-Fi | Kids app |
|---|---|---|---|---|---|---|---|
| Malware and phishing | Block | Block | Block | Block | Block | Block | Block |
| Adult websites | Block | Block on minors' devices | Block | Block | Block | Block | Block |
| VPN and proxy | Block | Often | Often | Add-on | Often | Rarely | Block |
| Cryptomining | Block | Often | Block | Block | Often | Often | Block |
| Ads and trackers | Optional | Rarely | Optional | Per client | Opt in | Rarely | Common |
| Social media | Policy call | Rarely | Policy call | Per client | Opt in | Rarely | Parent toggle |
| AI tools | Policy call | Rarely | Allow approved only | Per client | Rarely | Rarely | Parent toggle |
Schools in the United States should read the CIPA web filtering overview, since funding rules shape the school column. For company networks, see corporate web filtering.
Each list below has its own page covering what is in it, how large it is, how it stays current, which formats it ships in, how to deploy it and how to handle false positives.
Credential phishing, malware delivery and suspicious lookalike domains. The one list every network should run.
Category: Malware / Phishing / SuspiciousExplicit sites, their mirrors and media hosts, with optional neighbouring categories for strict networks.
Category: Adult, plus optional Lingerie and DatingCommercial VPN services, web proxies and anonymizers that let users step around the rest of your policy.
Category: VPN / Proxy / AnonymizersMining pools, browser mining scripts and mining services that burn power and signal compromise.
Built from mining-related security and crypto categoriesAd networks, ad servers and tracking hosts, for privacy, bandwidth and cleaner kids' experiences.
Category: Advertising/MarketingSocial networks with their media and content delivery domains, so a block actually holds.
Category: Social Networking, plus related setsChat assistants, image generators, companions and thousands of smaller AI tools, split into subcategories.
Category: AI / LLM Tools, 16,000+ domains in 18 subcategoriesGambling, weapons, file sharing, URL shorteners, parked domains and the rest of the 59 categories.
Every category can become its own listRolling everything out on day one floods the help desk. Adding lists in layers lets you learn what each one catches before the next goes live.
Malware and phishing plus cryptomining. These lists protect everyone and almost nobody argues with them.
Week 1, blockVPN and proxy domains, plus encrypted DNS controls. Without this layer, every later list can be skipped.
Week 2, blockAdult, gambling and the other content your sector or local law expects you to restrict.
Week 2 to 3, blockSocial media, AI tools, streaming and games. Often time-based, group-based or set to warn first.
Week 4, warn then decideAds and trackers, parked domains and URL shorteners. Useful, but the most likely to break page features.
Pilot group firstRun each layer in log-only mode for a few days first. The logs show which popular domains a list would catch on your network, so you can add allow entries before users notice.
The same list can sit at several points in the network. Each point sees different traffic, so pick the one that covers the devices you care about.
Covers every device using your DNS. Cheap, fast and works for phones and IoT devices. Blind to full URLs.
Reads lists as objects in rules and can log by user or group. Watch per-model entry limits.
Sees full hostnames and, with inspection, URLs. Best for block pages and per-user reports.
Follows laptops and phones off the network. The route parental control and security apps take.
The DNS filtering vs web filtering guide compares these points in depth, and the blocklist formats guide shows the file layout each one reads.
Many teams start with a spreadsheet of sites someone complained about. It works for a month, then quietly falls behind.
Keep a small manual list for the things only you know, such as an internal tool that must stay reachable. Everything else belongs in categories. The block websites by category guide walks through the setup.
A block list is only as good as its last update. Licensed lists follow a fixed rhythm so you can plan around it.
About 300,000 newly registered domains are categorized daily and ship as delta files.
Each new domain is checked again, because many sites only add real content after launch.
A further check catches sites that changed purpose, went parked or turned hostile.
All other domains are refreshed monthly, and regular manual validations measure accuracy.
Want to see the logic behind blocking new names early? Read how to block newly registered domains.
Licensed customers receive source files and, on request, exports shaped for their enforcement points.
Building a resolver product? See DNS filtering integration, or the managed DNS filter if you would rather not run one.
Need to block one app or site type right now? These guides cover router, firewall, DNS and device methods for each.
Each category also has its own page, for example gambling sites, file sharing and parked domains.
Most blocklist problems come from a few habits. Fixing them early saves weeks of complaints.
If devices can use any public resolver or encrypted DNS, the list only stops people who never try. Force DNS through your resolver.
Overlapping lists with no owner cause random breakage that nobody can explain. Fewer, categorized lists are easier to run.
Apps load media and APIs from many domains. Blocking only the main name leaves the app half working.
Routers struggle with huge lists. Trim to the most visited domains and keep the full set at the resolver.
A silent failure looks like a broken internet. A block page with a reason and a request link cuts tickets.
A list loaded once and forgotten loses value every day. Automate the download and alert on failures.
A full category export can hold millions of lines. Not every device can load that, and not every device needs to. Trim by popularity first, then by category.
| Enforcement point | Typical capacity | Suggested scope | Best format | Update rhythm |
|---|---|---|---|---|
| Home router or small office gateway | Limited memory, often tens of thousands of entries | Most visited domains in your chosen categories | dnsmasq or hosts | Weekly or daily |
| Home and office DNS box | Hundreds of thousands to low millions | Popular domains plus security lists in full | Adblock style or plain list | Daily |
| Next-generation firewall | Set by model and licence, check the data sheet | Security lists in full, content lists trimmed | External dynamic list | Daily fetch |
| Recursive resolver | Millions of records with enough memory | Full category exports | DNS RPZ | Daily delta, monthly full |
| Cloud filtering service or product | Effectively unlimited | All 120 million domains with every category | Parquet, CSV or JSON plus the lookup API | Daily delta, monthly full |
Popularity is the best trimming rule. Because the 20 million most visited domains carry 99.99% of real traffic, a list cut to popular names still blocks what people actually try to open.
The same network often serves people with very different needs. Category lists make it easy to give each group its own mix without keeping separate files.
Security, bypass control, all safety content, plus social media and AI tools during lessons.
Security and bypass control, adult and gambling, with social media and approved AI tools open.
Security and adult only, so visitors rarely hit a block page they cannot explain.
Security, cryptomining and remote access tools, with most other traffic logged for review.
Group-based rules need the enforcement point to know who is asking, through user sign-in, network segment or device profile. The custom policy management guide covers how products usually model this.
Every network should block malware, phishing and suspicious domains. Most also block VPN and proxy services, because those let users route around every other rule. Content lists such as adult or gambling depend on who uses the network.
Block by category and keep a short manual list for exceptions. Individual domain lists go stale within weeks, because new sites appear every day, while a category list is refreshed for you.
It depends on the device. Resolvers and cloud services can hold full category lists, while routers and some firewalls have entry limits. The 20 million most visited domains cover 99.99% of web traffic, so a list trimmed to popular domains still covers almost all real use.
Security lists need daily updates. Content lists also gain new domains every day, so daily delta files plus a monthly full refresh is a sound rhythm for both.
Use the format your enforcement point reads natively: DNS RPZ for resolvers, hosts or adblock style for small DNS boxes, external dynamic lists for firewalls, and CSV, Parquet or JSON if you build your own product.
It depends on the format and the tool. Adblock style rules, dnsmasq, Unbound local zones and RPZ zones with a wildcard entry cover subdomains, while hosts files only match the exact name. Check how your enforcement point reads each line before rollout.
Yes, if the app uses your network's DNS. Apps look up their servers by name like browsers do, so a list that includes the app's content and API domains stops it. Apps with built-in encrypted DNS or VPN features need the bypass layer as well.
Starter database tiers start from $999. Enterprise and OEM licences are quoted per deployment, based on how the data is used and how many products it ships in. See pricing or OEM licensing.
License 120 million categorized domains in 59 categories, with daily new-domain deltas and exports for resolvers, firewalls, proxies and apps.