diff --git a/src/app_state.rs b/src/app_state.rs
index 1b9193e..1ed0597 100644
--- a/src/app_state.rs
+++ b/src/app_state.rs
@@ -11,6 +11,7 @@ pub struct RelayServer {
     pub db_history: sled::Tree,
     pub db_users: sled::Tree,
     pub db_index_cursors: sled::Tree,
+    pub db_banned_hosts: sled::Tree,
 
     pub plc_resolver: Cow<'static, str>,
     pub known_good_hosts: Mutex<BTreeSet<String>>,
@@ -44,7 +45,10 @@ impl RelayServer {
             db_users: db.open_tree("users").expect("failed to open users tree"),
             db_index_cursors: db
                 .open_tree("index_cursors")
-                .expect("failed to ope index_cursors tree"),
+                .expect("failed to open index_cursors tree"),
+            db_banned_hosts: db
+                .open_tree("banned_hosts")
+                .expect("failed to open banned_hosts tree"),
             db,
         }
     }
@@ -74,4 +78,13 @@ impl RelayServer {
         self.db.insert("hosts", serialized_hosts)?;
         Ok(())
     }
+
+    pub fn is_banned_host(&self, host: &str) -> Result<bool> {
+        if host.ends_with(".bsky.network") {
+            return Ok(true);
+        }
+
+        let explicit_ban = self.db_banned_hosts.contains_key(host)?;
+        Ok(explicit_ban)
+    }
 }
diff --git a/src/relay/index.rs b/src/relay/index.rs
index d058440..7a4ba5d 100644
--- a/src/relay/index.rs
+++ b/src/relay/index.rs
@@ -457,6 +457,13 @@ async fn host_subscription(server: Arc<RelayServer>, host: String) -> Result<()>
 }
 
 pub async fn index_server(server: Arc<RelayServer>, host: String) -> Result<()> {
+    if server.is_banned_host(&host)? {
+        bail!("refusing to start indexer for banned host '{}'", &host);
+    }
+
+    // TODO: we should have some kind of Indexer that we can tell to cancel when a server gets banned in-flight
+    // instead of just having a BTreeSet<String> :)
+
     {
         let mut active_indexers = server.active_indexers.lock().await;
         if active_indexers.contains(&host) {