How to block YouTube with DNS

DNS cannot make a clean YouTube block

DNS turns a domain name into a network address. A DNS filter can refuse that lookup. It cannot see the channel, video, account, page, or reason for watching.

Blocking youtube.com may stop the main website while an app still uses other YouTube hosts or a cached connection. Blocking enough extra hosts to stop playback also stops YouTube embeds across the web and can disrupt Google account handoffs.

Use DNS only when you accept an all or nothing block and its side effects.

What the common domains cover

• youtube.com serves the main site, account pages, and standard embeds.
• youtu.be serves short links.
• youtube-nocookie.com serves privacy enhanced embedded players.
• googlevideo.com carries much of the video stream.
• ytimg.com serves thumbnails and other static parts of YouTube.

Google tells network admins to allow youtube.com for normal embeds and youtube-nocookie.com for privacy enhanced embeds in its YouTube embed guide. A block on those domains therefore affects videos placed on school, news, and blog pages.

Do not block broad Google domains such as google.com, googleapis.com, or gstatic.com to chase every failed request. Those hosts serve many Google products. A wider rule can break Google sign in, fonts, images, classroom tools, and sites that have nothing to do with YouTube.

Test a DNS block without hiding the damage

1. 1

   Decide the scope. Put the DNS rule on one device or child group when your resolver supports clients. A router level resolver may apply it to the whole home.

2. 2

   Add youtube.com, youtu.be, and youtube-nocookie.com to the deny list. Save the rule, clear cached lookups, and restart the test device.

3. 3

   Test the YouTube site and app. If video still plays, add googlevideo.com and test again.

4. 4

   Test a YouTube video embedded on a school site. Test Google sign in and every Google tool the child needs.

5. 5

   Remove the rule if the damage is wider than the goal. Keep a note of every domain you changed so rollback is quick.

The result can vary by app, device, and date because YouTube can change which host serves a request. A list that works today may miss a path after an app update.

DNS is easy to route around unless the network forces it

A device can choose another DNS resolver. Browsers and VPNs can carry encrypted lookups that the home resolver never sees. Cellular data and phone hotspots do not cross the home network at all.

A service can also connect to a known IP address without asking your DNS server again. Typing a bare IP into a browser may fail because HTTPS still checks the host name, but the missing DNS lookup shows why a deny list is not a firewall.

To make a resolver rule harder to bypass, a router must force local DNS and block outside DNS paths. That needs firewall support and careful testing. A plain DNS server address in the router is not enough.

Better choices for the common goals

• No internet after bedtime: use a router profile schedule. It stops more than one domain and is easier to test.
• No YouTube on one phone or tablet: use Screen Time or Family Link on that device.
• Keep YouTube but block an exact channel: use a supervised YouTube account or a content rule on the computer.
• Block YouTube for every home device: use a router app or service block if the router names YouTube directly.

Google now supports exact channel blocks for supervised child accounts. Family Center can also set the daily Shorts feed limit to zero.

Vidward is not a DNS filter. It is a desktop browser extension plus a parent dashboard. It cannot change a resolver or block phones, tablets, TVs, consoles, or the network. It fits only when a child may keep YouTube on a computer but needs narrower rules inside a desktop browser.

For a home network plan, read how to block YouTube on your router. For two DNS tools, see the Pi-hole guide and OpenDNS guide.