3Eyes / Blog
2026-08-06 · Sienna Richardson

Roblox Domains to Block: The Complete Copy-Paste List (2026)

Most parents block roblox.com, watch the site fail to load, and assume they are done. Then the desktop client launches anyway. Roblox is not one domain — the website, the login service, the game-joining API, the asset CDN and the client updater all live on separate hostnames, and the game client barely touches roblox.com at all once it is installed.

This page is the full list, sorted by what each domain actually does, in copy-paste format for the hosts file, your router, Pi-hole, AdGuard Home and pfSense. It also covers the ports the client uses, what you should not block, and — the part almost every guide skips — how to verify the block worked rather than hoping it did.

This is the domain-level companion to our full guide on how to block Roblox on PC, laptop and Mac, which covers the built-in Windows and macOS controls.

The Short Answer: The Minimum Effective List

If you only paste one block of text, paste this. These fifteen hostnames cover the website, authentication, game joining and the client updater — enough that neither the browser nor the installed app can reach a playable game.

roblox.com
www.roblox.com
web.roblox.com
m.roblox.com
api.roblox.com
apis.roblox.com
auth.roblox.com
users.roblox.com
games.roblox.com
gamejoin.roblox.com
clientsettings.roblox.com
clientsettingscdn.roblox.com
assetdelivery.roblox.com
setup.rbxcdn.com
rbxcdn.com

If your router or filter supports wildcards, *.roblox.com plus *.rbxcdn.com replaces the entire list and is more durable, because it automatically catches hostnames Roblox adds later. Prefer wildcards wherever they are available.

What Each Domain Actually Does

Blocking blind is how people end up with a half-working block they cannot debug. Here is what each group is for, so you can tell which one you missed when something still loads.

Domain group What it does Effect if you block it
roblox.com, www., web., m. The website and mobile web Browser play stops; installed client unaffected
auth.roblox.com, users.roblox.com Login and account identity Cannot sign in anywhere, app included
api.roblox.com, apis.roblox.com General platform API Most in-app features break
games.roblox.com, gamejoin.roblox.com Finding and joining game servers Client opens but cannot enter any game
clientsettings.roblox.com, clientsettingscdn.roblox.com Client configuration on launch Client hangs or fails at startup
assetdelivery.roblox.com, rbxcdn.com, setup.rbxcdn.com Assets, textures, client installer/updater Games will not load content; cannot install or update
ecsv2.roblox.com, metrics.roblox.com Telemetry Cosmetic only — not worth blocking on its own

The two that matter most are the auth group and the gamejoin group. Blocking authentication alone stops nearly everything, because a signed-out client cannot join a server. If you are limited to a handful of entries, start there rather than with www.roblox.com.

Hosts File Format (Windows, Mac and Linux)

The hosts file redirects a hostname to a dead address before any network request leaves the machine. Paste this at the bottom of the file:

127.0.0.1 roblox.com
127.0.0.1 www.roblox.com
127.0.0.1 web.roblox.com
127.0.0.1 m.roblox.com
127.0.0.1 api.roblox.com
127.0.0.1 apis.roblox.com
127.0.0.1 auth.roblox.com
127.0.0.1 users.roblox.com
127.0.0.1 games.roblox.com
127.0.0.1 gamejoin.roblox.com
127.0.0.1 clientsettings.roblox.com
127.0.0.1 clientsettingscdn.roblox.com
127.0.0.1 assetdelivery.roblox.com
127.0.0.1 setup.rbxcdn.com
127.0.0.1 rbxcdn.com

Windows: the file is at C:\Windows\System32\drivers\etc\hosts. Open Notepad as administrator (Start > type Notepad > right-click > Run as administrator), then File > Open, set the file-type dropdown to All Files, and navigate to that path. Save, then run ipconfig /flushdns in Command Prompt.

Mac: run sudo nano /etc/hosts, paste at the bottom, save with Control+O then Control+X, then run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.

Linux: the file is /etc/hosts; edit with sudo nano /etc/hosts. Most distributions need no cache flush, but sudo systemd-resolve --flush-caches covers systemd-resolved.

The hosts file does not support wildcards — 127.0.0.1 *.roblox.com silently does nothing. That is its main weakness here, and the reason router-level blocking is more durable. Our hosts file walkthrough covers the same technique in more detail.

Router, Pi-hole, AdGuard Home and pfSense Formats

Network-level blocking covers every device on the Wi-Fi at once, including consoles and tablets where you cannot edit a hosts file.

Most consumer routers (look for Parental Controls, Access Restrictions, or URL Filtering) take plain keywords or domains. Enter roblox.com and rbxcdn.com. If there is a keyword-blocking field rather than a domain field, the single keyword roblox catches everything, at the cost of also blocking any page with "roblox" in the URL — including this one.

Pi-hole: Settings isn't the place — use the Domains page, choose Regex filter, and add:

(\.|^)roblox\.com$
(\.|^)rbxcdn\.com$

Two regex lines replace the entire hostname list and cover future subdomains automatically.

AdGuard Home: under Filters > Custom filtering rules:

||roblox.com^
||rbxcdn.com^

pfSense / OPNsense with pfBlockerNG: add roblox.com and rbxcdn.com to a DNSBL feed as wildcard entries. pfBlockerNG treats a bare domain as covering all subdomains, so no wildcard character is needed.

Full router walkthroughs, including which menu each brand hides this under, are in our guide on blocking Roblox at the router.

Ports: Blocking the Game Client Directly

Domain blocking is the right primary tool, but the Roblox client also has a recognisable network fingerprint.

The client connects outbound over UDP ports 49152–65535 for actual gameplay, and uses TCP 443 for everything else. Blocking that UDP range at the router firewall stops gameplay even if a hostname slips through your DNS filter.

Be careful with it. That UDP range is the standard ephemeral port range and is also used by video calls, VoIP, and many other games. Blocking it wholesale will break Zoom, FaceTime and Discord voice. Use it only as a targeted rule against a specific device, and only if domain blocking has already failed.

Never block TCP 443 broadly. That is HTTPS — you would block the entire web, not Roblox.

What You Should Not Block

A few entries appear on other lists and cause more problems than they solve.

  • roblox.qq.com — this is the separate Chinese version (LuoBuLeSi), operated by Tencent. Harmless to include, but irrelevant outside mainland China.
  • rbxcdn.com wildcards on a loose-matching router — some consumer routers match substrings rather than domains, so a rbxcdn keyword rule can catch unrelated hostnames. Test before assuming.
  • Whole-of-amazonaws.com or Cloudflare ranges — Roblox assets are served through major CDNs that host a large share of the internet. Blocking the CDN blocks thousands of unrelated sites, including school portals and homework tools.
  • IP addresses — do not block Roblox by IP. The addresses sit behind CDNs, rotate constantly, and are shared with other tenants. A blocked IP will be stale within weeks and may take an unrelated service down with it.

How to Verify the Block Actually Worked

This is the step that separates a block that holds from one that quietly does nothing.

1. Check DNS resolution. On Windows, open Command Prompt and run nslookup roblox.com. On Mac or Linux, run dig roblox.com +short. If your block is working you should see 127.0.0.1, 0.0.0.0, or no answer at all. If you see a real public IP address, the block is not being applied to that machine.

2. Check the client, not just the browser. Launch the Roblox app itself and try to join a game. A working browser block with a working app is the single most common failure, and it means you blocked the web group but missed gamejoin or clientsettings.

3. Test from the child's account, not yours. Filtering rules are often per-user or per-device. Sign in as them and repeat both tests.

4. Test on mobile data. Put a phone on cellular and try Roblox. If it works, your block is network-level only and vanishes the moment your child uses a hotspot — see the bypass section below.

How Kids Get Around a Domain Block

An honest account, because a block you believe in more than it deserves is worse than no block.

  • A VPN or proxy routes DNS around your filter entirely. This defeats hosts files, router blocking and DNS filtering simultaneously. Covered in can a VPN bypass parental controls.
  • Editing the hosts file back takes about thirty seconds — and requires admin rights, which is exactly why your child's account should be a Standard user.
  • Changing the device's DNS to 8.8.8.8 in network settings bypasses a Pi-hole or router-level filter in four clicks.
  • A mobile hotspot bypasses every network-level control you own.
  • Encrypted DNS (DoH) in Chrome or Firefox sends DNS lookups over HTTPS to a resolver you do not control, silently skipping your filter. Disabling it is browser-specific and it re-enables on updates.

The structural problem is that all of the above are blocklists: you are enumerating what to forbid, and every new domain, mirror or proxy is a gap until you add it. An allowlist inverts that — nothing loads unless it is approved, so a domain you have never heard of is already handled. That is the approach behind parental controls kids can't bypass.

Where 3Eyes Fits

The list above is accurate today. That is the problem with every blocklist: it is a snapshot, and it needs maintaining every time a new subdomain appears.

3Eyes avoids the maintenance entirely by working the other way round. Nothing opens unless you have approved it, so a Roblox domain nobody has catalogued yet is already blocked. It runs on the computer rather than the router, so it holds on any network, and it installs in about two minutes. See the features.

Frequently Asked Questions

Is there one single domain that blocks all of Roblox?

No, but auth.roblox.com comes closest. Without authentication the client cannot sign in or join a server. Wildcard-blocking *.roblox.com is the true one-line answer where your filter supports it.

Will blocking these domains break Roblox Studio?

Yes. Studio uses the same authentication and asset endpoints. If your child uses Studio for coding or game development, blocking Roblox blocks that too — there is no way to separate them at the domain level.

Do I need to block IP addresses as well?

No, and you should not. Roblox sits behind shared CDNs with rotating addresses, so IP blocks go stale quickly and risk taking unrelated sites down with them. Block by domain.

Why does Roblox still work after I edited the hosts file?

Three usual causes: the DNS cache was not flushed, the browser is using encrypted DNS (DoH) which skips the hosts file, or the file was not saved because the editor lacked administrator rights. Run the nslookup check above to tell which.

How often does this list need updating?

Roblox adds and retires subdomains regularly, so an explicit list drifts over months. Wildcard rules (*.roblox.com) do not have this problem, which is the strongest argument for using them wherever your filter allows.