---
title: Block Access to Specific Domain Names with a Block List
canonical: https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/block-access-to-specific-domain-names-with-a-block-list/
product: CloudConnexa Docs
description: Configure a Domain Block List in a CloudConnexa Shield Policy to block specific domains beyond your content category settings — add domains manually or by .txt upload, search and download the list, and manage Block and Allow List precedence rules.
keywords: Block List, domain filtering, domain blocking, domain blocklist, Cyber Shield, Shield Policy
---

# Block Access to Specific Domain Names with a Block List

## Overview

Configure a Domain Block List per Shield Policy to always block specific domains for users covered by that policy. The Domain Block List functions as a custom domain filtering category and is configured on the policy's **Domain Block List** tab.

You can enter domains directly or use a .txt file for batch upload. Each Domain Block List supports up to 150,000 characters.

The Domain Block List works only while Domain Filtering is on for the policy.

For more information about how filtering settings apply per policy, refer to [About Shield Policies](https://openvpn.net/cloud-docs/owner/shield/shield---policies/about-shield-policies.md). To determine which User Groups receive the Block List settings, refer to [Assign User Groups to a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/assign-user-groups-to-a-shield-policy.md).

## Before you begin

Ensure you have a Shield Policy to configure.

You can configure the **Default Policy** or a custom Shield Policy. To create a custom policy, refer to [Create or Edit a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/create-or-edit-a-shield-policy.md).

## Add domains to the Domain Block List

Add domains directly when you have a small number of entries to configure.

1. Sign in to your WPC's Administration Portal at your **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Shield → Policies**.
3. Select the **Edit policy** icon for an existing policy with Domain Filtering turned on.
4. Select **Domain Block List**.
5. Turn on **Enable Block List**.
6. Enter the domains you want to block, with one domain per line.
7. Review the list.
8. Select **Save changes**.
   - The Domain Block List applies to users covered by the Shield Policy.

> **Note**
>
> Changes may not apply immediately to domains that were previously visited because of local caching.

## Upload a Domain Block List

Use **Upload List** to perform a batch upload of domains from a `.txt` file.

1. Open the Shield Policy and select the **Domain Block List** tab.
2. Turn on **Enable block list**, if it isn't already on.
3. Select **Upload List**.
4. Select the `.txt` file containing your Domain Block List.

   > **Important**
   >
   > **Upload List** replaces the current Domain Block List. It doesn't append the uploaded domains to the existing list.

   > **Note**
   >
   > The list can contain up to 150,000 characters. Entries must use valid domain formats and ASCII characters.
5. Review the uploaded domains.
6. Save your changes.

## Add a comment to the Domain Block List

Use `#` to add comments to the Domain Block List. Comments can help identify or organize groups of domains and aren't treated as domain entries.

1. Open the Shield Policy and select the **Domain Block List** tab.
2. Add `#` at the beginning of the line (or use `CTRL+` on Windows or `⌘+/` on macOS), followed by your comment. For example:

   ```
   # Social media
   example.com
   example.org

   # Development services
   dev.example.net
   ```
3. Add or edit the domain entries as needed.
4. Save your changes.

   > **Tip**
   >
   > You can include comments when you enter domains directly or in a `.txt` file used with **Upload List**.

## Search the Domain Block List

Use search to find a domain or comment in the current Domain Block List.

1. Open the Shield Policy and select the **Domain Block List** tab.
2. Select anywhere inside the **Blocked Domains** field.
3. Press `Ctrl+F` on Windows or `⌘+F` on macOS.
4. Enter the domain or text you want to find.
5. Use the search bar arrows to move through matching entries.

## Turn the Domain Block List on or off

Use **Enable block list** to control whether the policy uses its configured Domain Block List.

1. Open the Shield Policy and select the **Domain Block List** tab.
2. Turn **Enable block list** on or off.
3. Save your changes.
   - Turning off **Enable block list** retains the configured domains but stops the Block List from affecting Domain Filtering.

   > **Important**
   >
   > The Domain Block List works only while **Domain Filtering** is on. If you turn off Domain Filtering for the Shield Policy, **Enable block list** turns off and is disabled.

## How Domain Allow List and Block List entries match

The **Domain Allow List** and **Domain Block List** use domain name matching to determine whether an entry applies to a domain or its subdomains.

A domain entry applies to that domain and its subdomains. You can create an exception for a specific subdomain by adding it to the opposite list.

### Domain name matching examples

| **Domain Allow List** | **Domain Block List** | **Result** |
| --- | --- | --- |
| `google.com` | — | `google.com` and its subdomains are allowed. |
| `google.com` | `mail.google.com` | `google.com` and its other subdomains are allowed, but `mail.google.com` is blocked. |
| — | `google.com` | `google.com` and its subdomains are blocked. |
| `mail.google.com` | `google.com` | `google.com` and its other subdomains are blocked, but `mail.google.com` is allowed. |

CloudConnexa evaluates domain names from right to left, beginning with the top-level domain (TLD). A more specific subdomain entry on the opposite list overrides the broader parent-domain entry.

### How the lists affect Domain Filtering

The Domain Allow List and Domain Block List also take precedence over the policy's content-category settings:

- A domain on the **Domain Allow List** is always allowed, even if its content category is blocked.
- A domain on the **Domain Block List** is always blocked.

> **Important**
>
> Don't add the same domain to both lists. CloudConnexa reports a conflict when an identical domain appears on both the Domain Allow List and Domain Block List. Remove the domain from one list before saving your changes.

## Resolve Domain Block List validation errors

If CloudConnexa reports an error or warning, check the Domain Block List for:

- Invalid domain formats.
- Non-ASCII characters.
- Duplicate domains.
- Domains that are also on the Domain Allow List.
- A list that exceeds the 150,000-character limit.

Correct the entries, then save your changes.

## What happens next

Domains on the enabled Domain Block List are always blocked for users covered by the Shield Policy, regardless of their content category settings.

To make a specific domain accessible when its content category would otherwise be blocked, refer to [Domain Allow List](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/override-blocked-domains-with-a-domain-allow-list.md).

> **Tip**
>
> Changes may not apply immediately to previously visited domains because of local caching.

## Related resources

- [About Shield Policies](https://openvpn.net/cloud-docs/owner/shield/shield---policies/about-shield-policies.md)
- [Create or Edit a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/create-or-edit-a-shield-policy.md)
- [Assign User Groups to a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/assign-user-groups-to-a-shield-policy.md)
- [About Cyber Shield](https://openvpn.net/cloud-docs/owner/shield/about-cyber-shield.md)
- [Domain Filtering](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/domain-filtering-protection-levels-and-content-categories.md)
- [Configure Domain Filtering](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/configure-domain-filtering-for-a-shield-policy.md)
- [Domain Allow List](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/override-blocked-domains-with-a-domain-allow-list.md)

---

Prev: [Domain Allow List](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/override-blocked-domains-with-a-domain-allow-list.md)
Next: [Shield - Policies - Traffic Filtering](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---traffic-filtering.md)
Index: https://openvpn.net/cloud-docs/llms.txt