diff --git a/src/Middleware/PreventAccessFromTenantDomains.php b/src/Middleware/PreventAccessFromTenantDomains.php
new file mode 100644
index 00000000..7a4c80b7
--- /dev/null
+++ b/src/Middleware/PreventAccessFromTenantDomains.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Stancl\Tenancy\Middleware;
+
+use Closure;
+
+class PreventAccessFromTenantDomains
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        // If the domain is not in exempt domains, it's a tenant domain.
+        // Tenant domains can't have routes without tenancy middleware.
+        if (! in_array(request()->getHost(), config('tenancy.exempt_domains')) &&
+            ! in_array('tenancy', request()->route()->middleware())) {
+                abort(404);
+        }
+
+        return $next($request);
+    }
+}