How to block TikTok on every device in the house

Blocking tiktok.com in a browser achieves almost nothing, because nobody uses TikTok in a browser. The app talks to its own hosts directly, ignores browser extensions entirely, and reinstalls in thirty seconds.

Filtering at the DNS layer sits underneath that. The app still has to resolve a hostname before it can reach anything, so a rule set once applies to the app, the website and the embeds on other people’s pages — and it applies on a console or a television where there is nothing to install.

1. Create a profile for the device or for the whole house. One profile carries one set of rules, so a child’s tablet and your own phone can differ.
2. Find TikTok in the list of services and switch it on. You pick it by name — there is no list of addresses to assemble or maintain.
3. Point the device at that profile’s resolver address, or set it on the router to cover everything on the network at once. The setup guide has the steps per platform.

The change takes effect at the resolver, so it applies immediately to every device on that profile without touching any of them.

A total block is often the wrong tool, and it is the version that gets argued about and then switched off. A schedule moves a profile between policies by time of day and day of week — TikTok unavailable during school hours and homework, back afterwards — without anyone having to remember to change anything.

Schedules are part of the same profile, so the rule follows the device rather than the network.

There is a middle setting people miss. TikTok Tracking blocks the fingerprinting and analytics endpoints while leaving the app working — useful on an adult’s phone where the goal is privacy rather than abstinence.

The two are separate switches, so you can run the tracking block everywhere and the full block only where it is wanted.

Almost always one of these, in the order they usually turn out to be true.

• The device is on mobile data. A phone set up only through the router is unfiltered the moment it leaves the house. Phones need their own profile configured on the device.
• A VPN is carrying its own DNS. Most VPN apps resolve through their provider, which bypasses the filter completely. To resolve this, check with your VPN provider on how to configure your device to use your custom DNS as opposed to the DNS from your VPN.
• The browser is going its own way. Chrome and Firefox have a secure-DNS setting of their own that can override the device’s. Worth a look if the app is blocked but the website is not.
• The device is remembering. It may hold on to the old answer for a few minutes. Turning Wi-Fi off and on clears it.

The dashboard’s troubleshooting page queries your profile directly and shows the answer it got, which separates “the rule is not doing what I thought” from “this device is not using the resolver at all”.

Always keep in mind the difference between home devices and mobile devices. Home devices always stay home but mobile devices can leave the home. For mobile devices, do not only rely on network-wide DNS configuration since this will not follow a mobile device that leaves home. Rather, also set up DeCloudUs DNS profile directly on the mobile device so that your DNS rules stay effective inside or outside the home.