Block YouTube with Pi-hole (Self-Hosted DNS Sinkhole, 2026)
Block YouTube on every device in your home using Pi-hole. Complete guide: hardware, installation, YouTube blocklists, network DNS setup, and known gotchas. Updated for 2026.
Advanced guide — less technical? Start with NextDNS
This guide is for users comfortable with a command line and basic networking. If that sounds daunting, start with the NextDNS guide instead — it achieves very similar results with a 10-minute setup and no hardware required.
What Is Pi-hole?
Pi-hole is a self-hosted DNS sinkhole — a small server you run on your own network. When any device asks "what's the IP address for youtube.com?", Pi-hole intercepts the question and answers with nothing, so the device never gets YouTube's real IP address.
This works network-wide: every phone, tablet, TV, games console, and laptop on your Wi-Fi is covered by a single configuration. You don't touch each device individually.
Advantages over hosted DNS services (CleanBrowsing, NextDNS):
- Full local control — no data leaves your home to a third-party DNS server
- Zero ongoing cost after initial hardware purchase
- Per-device statistics in the dashboard — you can see which device tried to reach YouTube and exactly when
- Blocks ads as a side effect across the whole network
- Unlimited queries, no tier limits
The trade-off: you maintain it. Pi-hole needs occasional updates, and if the hardware loses power, DNS stops working for everyone on your network.
Hardware Options
Option 1: Raspberry Pi (Recommended)
The Raspberry Pi is the classic Pi-hole host. Three viable models:
- Raspberry Pi Zero 2 W (~$15) — smallest and cheapest. Plenty of power for DNS. Wi-Fi only (no Ethernet port without adapter). Good choice if you want to hide it behind your router.
- Raspberry Pi 3 Model B+ (~$35) — has Ethernet, quad-core, still very low power draw. The most commonly recommended option for Pi-hole.
- Raspberry Pi 4 2GB (~$45) — overkill for Pi-hole alone but good if you want to run other services on the same Pi.
You also need: a microSD card (8GB minimum, Class 10, ~$8), the appropriate power supply for your Pi model, and optionally a case.
Option 2: Docker on Existing Home Server or NAS
If you already run a home server, NAS (Synology, QNAP), or any always-on Linux machine, you can run Pi-hole as a Docker container. Requirements: Docker installed, the machine has a static IP address on your network.
Option 3: Dedicated x86 Machine
Any old PC or mini PC running Ubuntu Server works well. A low-power Intel NUC or similar mini PC makes a capable always-on Pi-hole host.
Installation: Raspberry Pi Method
Step 1: Install Raspberry Pi OS Lite
Download Raspberry Pi Imager
Download Raspberry Pi Imager from raspberrypi.com/software. Install and open it.
Flash the OS to your SD card
In the Imager: select your Pi model, choose "Raspberry Pi OS Lite (64-bit)" as the operating system, and select your microSD card as storage. Before clicking Write, click the gear/settings icon to pre-configure: enable SSH, set a username and password, and configure your Wi-Fi network name and password. This saves you connecting a keyboard and monitor.
First boot
Insert the SD card into your Pi, connect power, and wait about 90 seconds for the first boot to complete.
SSH into the Pi
From another computer on the same network, connect using ssh yourusername@raspberrypi.local (replacing yourusername with what you set in step 2). If the hostname raspberrypi.local doesn't resolve, log into your router's DHCP table to find the Pi's IP address, then SSH to that IP directly.
Update the OS
Run sudo apt update followed by sudo apt upgrade -y to bring the system fully up to date before installing Pi-hole.
Step 2: Install Pi-hole
Run the Pi-hole installer
Pi-hole provides an official one-line install script. Visit pi-hole.net/install for the current install command — it's a single curl command that downloads and runs the installer. The installer is interactive and walks you through configuration.
Choose upstream DNS
During installation you'll choose which upstream DNS server Pi-hole uses for legitimate queries. Cloudflare (1.1.1.1) is recommended for privacy. Avoid Google (8.8.8.8) if privacy is a concern.
Enable the web admin interface
Accept the option to install the web admin dashboard. Once installed, the dashboard is accessible at http://[pi-ip]/admin or http://pi.hole/admin.
Note your admin password
The installer generates an admin password at the end of installation. Note it immediately. You can change it later by running pihole -a -p in the terminal.
Assign a static IP to the Pi
Pi-hole must have a fixed IP — if its IP changes, your router's DNS settings will break. The cleanest method is to reserve the Pi's MAC address in your router's DHCP settings (look for "DHCP Reservation" or "Static DHCP"). Alternatively, configure a static IP in the Pi's dhcpcd.conf file, but router-side reservation is easier to manage.
Step 3: Add YouTube Blocklists
Open the Pi-hole admin dashboard
Navigate to http://[pi-ip]/admin in a browser. Log in with your admin password.
Add YouTube domains to the Blacklist / Denylist
Go to Blacklist (older versions) or Denylist (v6+). Add each of the following domains individually:
youtube.comwww.youtube.comm.youtube.comyoutu.bemusic.youtube.comgooglevideo.com— essential: this is YouTube's video delivery CDN. Without it, the YouTube site may appear to load while videos still play.ytimg.com— thumbnail CDNyt3.ggpht.com— avatar/channel art CDNyoutubei.googleapis.com— YouTube's internal APIyoutube-ui.l.google.comwide-youtube.l.google.com
Add a community YouTube blocklist
Community-maintained blocklists catch YouTube domains that individual entries miss. Search GitHub for "pi-hole youtube blocklist" to find currently maintained lists. Add one via the dashboard: Adlists → paste the raw URL of the list → Save.
Update Gravity
After adding adlists, you must rebuild Pi-hole's database. Go to Tools → Update Gravity in the dashboard, or run pihole -g in the terminal. This pulls the adlists and builds the block database.
Installation: Docker Method
Create a docker-compose.yml file on your server with the following configuration (described in prose to avoid MDX parsing issues with code blocks):
Define a service named pihole using the pihole/pihole:latest image. Map port 53 (both TCP and UDP) on the host to port 53 in the container — this is the DNS port. Map port 80 on the host to port 80 in the container for the web admin interface. Set environment variables: TZ to your timezone (e.g. America/New_York) and WEBPASSWORD to a secure admin password. Define two named volumes: one for /etc/pihole inside the container and one for /etc/dnsmasq.d. Add restart: unless-stopped so Pi-hole comes back up after a reboot.
Start Pi-hole with docker compose up -d. Access the admin dashboard at http://[server-ip]/admin. Add YouTube domains to the Denylist using the same process described in the Raspberry Pi method above.
Step 4: Point Your Network DNS to Pi-hole
Method A: Configure Router DNS (Recommended)
Log into your router admin panel
See the generic router guide for instructions. Common addresses: 192.168.0.1 or 192.168.1.1.
Find DNS settings
Under WAN settings, Internet Setup, or DHCP settings depending on your router brand.
Set Primary DNS to Pi's static IP
Enter Pi-hole's IP address (e.g. 192.168.1.200) as the Primary DNS. Leave Secondary DNS blank.
Setting a fallback DNS (like 8.8.8.8) means that if Pi-hole is unavailable, devices automatically fall back to Google DNS — and YouTube loads freely. Leave it blank for strict blocking. Accept that Pi-hole downtime will mean no internet for those devices until Pi-hole recovers.
Restart router
Save settings and restart. All devices renewing their DHCP lease will begin using Pi-hole.
Method B: Pi-hole as DHCP Server
Disable DHCP on your router and let Pi-hole serve DHCP instead. This gives Pi-hole full visibility into per-device hostnames (you'll see "Emma's iPhone" in logs rather than an IP address). More advanced, not required for basic YouTube blocking.
Known Gotchas
Blocking googlevideo.com affects Chromecast
googlevideo.com is YouTube's video delivery CDN — you must block it or YouTube loads but videos play anyway. However, Chromecast uses googlevideo.com for all media delivery, including non-YouTube casting (Netflix, Spotify, etc.). Blocking it breaks Chromecast entirely.
Workaround: in Pi-hole, whitelist the specific IP address of your Chromecast device so it bypasses the googlevideo.com block. Go to Settings → DNS → Conditional Forwarding, or use the per-client override feature in Pi-hole v5+.
googlevideo.com blocking also breaks Google Search video preview thumbnails (minor) and YouTube Shorts embeds in third-party apps.
Blocking ytimg.com affects Google image search thumbnails
Blocking ytimg.com (YouTube's thumbnail CDN) occasionally causes broken image thumbnails in Google image search results. This is a minor cosmetic issue and doesn't affect Google Search functionality otherwise.
Pi-hole downtime = no internet for all devices
If the Pi loses power or crashes, all devices using it as their only DNS server appear to lose internet access. DNS stops resolving entirely.
Mitigation: set a backup DNS (8.8.8.8) on your own devices only — not child devices. On child devices, no secondary DNS means downtime actually enforces stricter blocking (no internet at all until Pi-hole recovers). This is often acceptable for the target use case.
How Kids Bypass This
Changing DNS on device: Tech-savvy users can open their device's network settings and switch to Google DNS (8.8.8.8). On iPhone, lock this via Screen Time → Settings → Content & Privacy Restrictions → prevent VPN and device management changes. On Android, Family Link restricts DNS changes.
Mobile data: Pi-hole only works on your home network. When a phone is on 4G/5G, it uses its carrier's DNS entirely. Pair Pi-hole with Screen Time (iPhone) or Family Link (Android) for mobile data coverage.
VPN apps: Any VPN completely bypasses Pi-hole by routing traffic through an encrypted tunnel. Block VPN app installation at the device level using Screen Time or Family Link.
Admin dashboard access: Anyone who knows the Pi-hole admin password can whitelist youtube.com in seconds. Keep the password secret and consider disabling the web dashboard entirely (run pihole -a -w [domain] via terminal only).
Counter-Measures
Block port 53 outbound on router: Prevents devices from manually switching their DNS to 8.8.8.8. Routers with firewall rules (ASUS with Merlin firmware, Ubiquiti UniFi, pfSense, OPNsense) can block all outbound port 53 traffic except to Pi-hole's IP. This is the single most effective hardening step.
Per-device statistics: Pi-hole's dashboard shows exactly which device attempted to reach blocked YouTube domains and when. Useful for identifying bypass attempts — a sudden spike in blocked queries from one device is a signal.
Keep Pi-hole updated: Run pihole -up to update Pi-hole itself. Run sudo apt update && sudo apt upgrade to update the underlying OS. Monthly maintenance is sufficient.
Pair with device-level controls for mobile data: Pi-hole covers your home network comprehensively, but devices on mobile data bypass it entirely. Screen Time (iPhone) and Family Link (Android) fill this gap. Both together create strong cross-context coverage.
Related Guides
Block YouTube with DNS Filtering (All Devices, Home Network, 2026)
Use DNS filtering to block YouTube on every device connected to your home Wi-Fi — including smart TVs, game consoles, and anything else. Free options available. Updated for 2026.
By MethodBlock YouTube with NextDNS (Complete Setup Guide, 2026)
Block YouTube on every device using NextDNS. Create a profile, add YouTube to the deny list, set up on your router and per-device. Free tier available. Updated for 2026.
By MethodBlock YouTube with OpenDNS (FamilyShield & Umbrella Home, 2026)
Block YouTube using OpenDNS FamilyShield or Umbrella Home. Set up on your router for network-wide blocking on every device. Free. Updated for 2026.
By MethodHow to Block YouTube with Firewalla (2026)
Block YouTube on every home device using a Firewalla Purple, Gold, or Blue Plus. Hardware-based network security with no monthly subscription. Step-by-step guide. Updated for 2026.
Want a personalised plan?
Answer 5 questions and get a guide for every device your child uses.
Take the Quiz →