---
description: How to run Tealium iQ Tag Management under a Content Security Policy, and how to send CSP violation reports to Report URI.
---

# Tealium

Tealium publishes a CSP reference guide listing the data centre domains for each of its products. The important part of their guidance is the bit people skip: as well as Tealium's own domains, you also have to allow the domains of every vendor you load *through* Tealium iQ Tag Management.

That is the crux of tag manager CSP work. The tag manager itself is one domain. What it loads is the actual problem.

## What Tealium gives you

- Per-product lists of data centre domains to add to your policy, covering domains that may be used in future as well as current ones.
- `tags.tiqcdn.com` as the source for Tealium iQ Tag Management's JavaScript.
- First-party domain support: configure a CNAME so `tags.tiqcdn.com` is served from a subdomain you control, which simplifies the policy and avoids a third-party origin.
- A documented Subresource Integrity publishing workflow, which pairs well with a CSP that requires integrity metadata.

## Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src 'self' tags.tiqcdn.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Your reports are the only realistic way to build the vendor half of the allowlist, because the set of vendors depends entirely on what is configured in your Tealium profile - not on anything documented.

## Things to watch for

- Publishing a new tag in Tealium can change what your pages load without any deployment on your side. A policy that was clean yesterday can start generating violations after someone else publishes a profile.
- The first-party domain route means allowlisting your own subdomain instead of `tags.tiqcdn.com`, which is tidier but also means a CSP violation no longer names Tealium - keep that in mind when reading reports.
- Because tag managers delegate the ability to add scripts to your pages, [Script Watch](/setup/script-watch/) and [Policy Watch](/setup/policy-watch/) cover the change-detection half that a policy alone does not.

## Official documentation

[Tealium - Content Security Policy](https://docs.tealium.com/server-side/settings/tealium-content-security-policies-reference-guide/)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)