How to disable Telegram DM requests from strangers?

Why unsolicited DMs are still arriving in 2026

Telegram 11.0 keeps three independent gates that decide whether an outsider can reach your inbox: phone-number visibility, global searchability and the “Who can add me to groups & channels” knob. A message request bypass is possible when any one of them is left open, so a checklist approach is safer than hunting for a single master switch.

The service also differentiates between “message requests” (shown in a separate tab) and direct delivery. If you have ever accepted even one request from a non-contact, Telegram remembers that user and delivers future messages straight into your main list. That historical consent is why some users still receive DMs after they “turned everything off”.

经验性观察：部分用户反馈，在关闭所有可见性选项后，若曾通过“消息请求”与某人互动，该对话会被系统视为“半信任”，后续消息不再经过请求筛选。要彻底断开，需手动“封锁”该用户，而非仅删除对话。

Compliance lens: what auditors ask for

Enterprise admins who must demonstrate GDPR or HIPAA data-minimisation controls need evidence that personal accounts used for work cannot be reached by unknown parties. Screenshots of the three privacy toggles plus a log of accepted message requests are usually enough for an external audit, provided the settings are locked behind a local passcode so the employee cannot reverse them during the retention period.

经验性观察：在跨国团队中，审计师通常要求提供“设置变更时间戳”与“设备本地密码策略”两项补充证据。你可以通过 Telegram 的“导出数据”功能生成 JSON 日志，再用 jq '.settings_privacy_rules[]' 提取变更记录，以满足更高阶的取证要求。

Fastest path to lock down your account

Android 11.0 and newer

1. Open Telegram → hamburger menu (≡) → Settings.
2. Privacy and Security → Phone Number → set to My Contacts.
3. While still inside Privacy and Security tap Groups & Channels → My Contacts.
4. Tap “Last Seen & Online” → Nobody or My Contacts (optional but recommended).
5. Back out once → tap “Calls” → Peer-to-Peer → Never or My Contacts.

完成后，建议重启应用以强制刷新云端规则缓存。若你使用多设备，桌面端与平板端将在数秒内同步变更，但 iOS 客户端偶尔需要手动下拉刷新“隐私”页才会显示最新状态。

iOS 11.0 and newer

1. Settings (cog tab) → Privacy and Security → Phone Number → My Contacts.
2. Same menu → Groups & Channels → My Contacts.
3. Optional: Settings → Notifications → In-App Notifications → turn off “Message Requests” badge if you never want to see the filtered queue.

iOS 的“消息请求”角标关闭后，陌生人来信将静默进入“请求”标签页，不再弹出红点。经验性观察：若你同时启用了 Apple Watch 镜像通知，该角标屏蔽也会同步到手表端，避免在健身或会议时被打断。

Desktop (Win / macOS / Linux) 11.0

1. ☰ → Settings → Privacy & Security.
2. The same three toggles are duplicated here; changes sync instantly.
3. Desktop adds a “Allow only contacts to call me” checkbox under Voice Calls—tick it.

桌面端独有的“仅联系人可呼叫”选项在 macOS 版中位于“语音通话”子菜单最底部，Windows 版则嵌套在“高级”折叠面板内。若你使用公司 AD 域账号登录 PC，建议通过注册表 HKCU\Software\TelegramDesktop\Privacy 备份这些布尔值，方便批量部署。

Verifying that the wall is up

Use a second Telegram account (a landline number on Fragment costs ≈ 0.7 TON) and search for your primary handle. If the privacy knobs are correct you will see “Sorry, this user is not available” when you try to send a message. No notification should appear on the primary device.

For an enterprise evidence pack, screenshot the second account’s view, annotate the timestamp and store it in the compliance folder. Repeat after every client update; Telegram has twice moved settings to new sub-menus (v9.5 and v10.3).

示例：在测试账号中输入 t.me/yourhandle 后，若页面直接跳转至“无法显示”，而非出现蓝色“发消息”按钮，即证明 Phone Number 与 Global Search 均已正确关闭。建议将截图文件命名为 telegram_privacy_audit_YYYYMMDD.png 并写入 SHA-256 校验值，方便后续比对。

Side effects you should anticipate

• Invitations to new work groups now require an existing member to add you; there is no knock request.
• If you run a public channel, subscribers can still reach you via the “Message Admin” button unless you disable it under Channel Info → Administrators → Anonymous Admin.
• Bot-initiated DMs are unaffected; disable them per-bot via Settings → Privacy → Bots → Stop Bot.

此外，开启“仅联系人”后，你在群组内 @ 陌生人时，对方将无法通过你的头像进入私聊，这在大型社群运营中可能降低客服效率。折中方案是保留一个公开的“业务用户名”，并在频道固定消息中声明“仅通过 @bizhandle 联系”。

When not to apply the strictest preset

Freelancers who list Telegram as a support line on their website need at least “Everybody can find by number” to let paying clients locate them. A practical compromise is to keep that gate open but set Groups & Channels to My Contacts, then use a secondary public username (@vendor2026) that forwards to a dedicated support bot with a short data-retention window.

经验性观察：部分外包平台在 2026 年初开始将“可联系 Telegram”列为卖家资质，若完全隐藏号码，可能导致店铺权重下降。建议定期导出“消息请求”统计，用 Google Data Studio 生成客户来源仪表盘，既满足合规，又保留营销漏斗。

Rolling back or selectively opening a gate

All three toggles remember their previous value for 30 days. If you temporarily choose “Everybody” to receive a conference invite, you can revert without losing the old whitelist. Accepted message requests, however, persist until you block the sender manually.

如需临时开放，可在桌面端使用“一键撤销”实验性功能（设置 → 隐私 → 恢复上次状态），该按钮在 11.0 中默认隐藏，需在搜索栏输入 restoreprivacy 才会显示。经验性观察：该功能每账号限用 3 次，防止被恶意反复切换。

Automated monitoring with a third-party bot

Some compliance teams connect a read-only bot to their corporate group to log every new member addition. While the bot cannot read private DMs, it can alert if an employee’s account is suddenly reachable (a sign that privacy toggles were relaxed). Use the Bot API getChatMember call every six hours and diff the can_send_messages flag; a change from false to true triggers a Slack webhook.

示例：使用 Python python-telegram-bot 库，将 ChatMemberUpdated 事件流推送到 AWS Lambda，通过 EventBridge 每 6 小时扫描一次，若检测到 old_chat_member.is_contact == False 且 new_chat_member.can_send_messages == True，立即向 SOC 发送告警。

Troubleshooting: “I still get message requests”

若以上场景均不匹配，可检查是否启用“附近的人”功能（Settings → Privacy → Location → Make Myself Visible）。该功能在 11.0 中默认关闭，但早期版本曾自动开启，残留数据可能导致陌生人通过距离维度发起请求。

Version differences you may hit

Telegram 10.x placed “Groups & Channels” inside “Advanced” on desktop; 11.0 surfaced it to the top-level Privacy menu. If you follow an outdated tutorial you may overlook the moved toggle. A quick way to confirm you are looking at the current layout is to search “privacy” in Settings; Telegram now indexes menu names.

Linux 社区包（如 Flatpak）曾因打包渠道延迟，在 11.0 发布两周后仍推送 10.9。经验性观察：在终端执行 flatpak info org.telegram.desktop | grep Version 可快速确认，若版本落后，建议切换至官方静态二进制以获得最新隐私路径。

Future outlook: what 11.1 beta hints

Test-flight strings show a new toggle: “Allow incoming business messages”. If shipped, it will separate commercial inquiries from social DMs, letting users keep the strict “My Contacts” preset while still receiving paying customer requests into a dedicated inbox. Until the feature reaches stable, the methods in this article remain the only reliable barrier.

此外，11.1 内测版中出现了“一次性语音邀请链接”功能，可能用于替代公开电话号，降低泄露风险。该链接在 30 分钟后自动失效，与当前“语音通话→仅联系人”策略互补，但尚未进入稳定通道，建议持续关注官方 changelog。

Checklist for zero unsolicited DMs

1. Phone Number → My Contacts
2. Groups & Channels → My Contacts
3. Last Seen → Nobody
4. Calls → Never (or My Contacts)
5. Block any remaining open request threads
6. Screenshot settings for audit trail
7. Re-verify with secondary account after every major update

Locking these three gates takes less than a minute, produces demonstrable evidence for privacy audits and removes the cognitive load of manually declining strangers. Until Telegram introduces granular business inboxes, the checklist above is the shortest compliance-ready path to a quiet inbox.

风险与边界

极端封闭策略会导致合法客户无法主动联系，适用于高度监管行业，但不适合需要公开获客的中小商家。若你运营付费社群，建议保留公开的“业务用户名”并使用 bot 做中间层，设置 7 天自动删除，既降低数据留存风险，又维持可达性。

随着 11.1 潜在的商业收件箱功能上线，用户有望在不牺牲隐私的前提下分离“社交”与“商业”信件。在官方正式释放该能力前，本文的七步清单仍是经过审计验证、可复现且零成本的最优解。保持每季度复测一次，即可在版本迭代中持续享有安静的收件箱。