SafeSearch is an automated filter of pornography and other offensive content that’s built into search engines. If anyone enters an inappropriate or suggestive phrase, no results will be returned that could be considered unsafe or problematic.
In the past, enforcing SafeSearch for internet search engines required that traffic to those domains be proxied, and URL parameters sent to them would then be modified to enforce the filtering level. The major search engines have recently begun providing DNS based methods for enforcing SafeSearch. This is done by by allowing the use of CNAMEs for their primary domains pointing to dedicated SafeSearch domains instead.
This method of enforcing SafeSearch is supported for Google, YouTube, and Bing.
How to use the SafeSearch feature in Umbrella
Turning this policy feature on is simple—it’s just a checkbox at the bottom of your Content Settings page, under Advanced Settings.
- Navigating to Policies > Management > All Policies and expand a policy.
- From the Summary screen, click Edit under ‘Content Setting Applied.’
- Under the list of categories, expand Advanced Settings and click the checkbox to enforce SafeSearch.
How to verify SafeSearch was enforced for a given query
Verification for the SafeSearch feature works slightly differently than other category blocks. The simplest and most reliable way to ensure it is working is to either visit the site that SafeSearch is enforced for and checking the SafeSearch settings are enabled. Alternatively, you can run a lookup from the command line to see if the redirection is working.
Both tests must be done on a computer whose policy has SafeSearch enabled. The two methods are outlined below.
Testing via Settings for Google, Youtube and Bing:
After searching in Google, you should see this in the top right corner.
Under Settings, you can select “Turn off SafeSearch”, but it will not have any effect.
Searching YouTube should show that “Restricted Mode” is on at the bottom of the results page. Expanding that will show that “Restricted Mode is enabled by your network administrator.
Under the menu icon in the top right corner, Bing will show that SafeSearch is set to “Strict”.
Clicking SafeSearch takes you to page describing SafeSearch, but the page will not give you an option to disable it.
Testing through a lookup from command line:
Looking up each domain via an nslookup should return the following results:
nslookup www.google.com Non-authoritative answer: Name: forcesafesearch.google.com Address: 126.96.36.199 Aliases: www.google.com
nslookup www.youtube.com Non-authoritative answer: Name: restrictmoderate.youtube.com Addresses: 2001:4860:4802:32::78 188.8.131.52 Aliases: www.youtube.com
nslookup www.bing.com Non-authoritative answer: Name: a-0017.a-msedge.net Address: 184.108.40.206 Aliases: www.bing.com strict.bing.com strict-bing-com.a-0001.a-msedge.net
Note: The last alias for www.bing.com may change based on geo-location. The important part is that it says "strict" in the domain.
How the service works for reports and blocks
Typically, when a site is blocked for inappropriate content, Umbrella’s DNS service returns the address of the block page to a user instead of the address of the website. The SafeSearch functionality is enforced by using a CNAME to point to the SafeSearch domain, so there’s no actual blocking taking place. Instead, requests are effectively redirected to domains which will restrict the results returned by the search engine. The only request is to the search engine’s site and not to a restricted site and it is not possible to determine the intent to bypass SafeSearch. It’s also not possible to see the redirect in our reporting.