SafeSearch enforcement for schools
Category filtering decides which websites open. SafeSearch decides what a search engine shows in its results, including image results, which is where many students first meet explicit content by accident.
This guide covers forced SafeSearch on Google, Bing and DuckDuckGo, YouTube Restricted Mode at DNS level, Chromebook settings in Google Admin, and how to test it all.
How DNS-level SafeSearch works
Each search engine runs a special address that always serves filtered results. The school's resolver quietly sends lookups for the normal address to that safe address, so users cannot switch it off in their settings.
1. Device asks for the engine
A student opens the search engine. The device asks the school's DNS resolver for its address.
2. Resolver answers with the safe host
Instead of the normal answer, the resolver returns the engine's safe hostname, as a CNAME or its address.
3. Engine serves locked results
The engine sees the request on its safe address and serves filtered results, with the setting locked on.
Why DNS beats per-device settings
One change on the resolver covers every laptop, tablet, phone and guest device on the network at once. Nobody has to visit each machine, and a student cannot untick a box to turn it off.
Why you still want device policy
DNS rules stop at the edge of your network. Device policy on managed Chromebooks and laptops carries the same setting home, to hotspots and to any network the device joins.
Pair result filtering with blocking at the domain
SafeSearch cleans up a results page, but a student who types an address directly never sees it. Our hosted CIPA filter covers that gap by category, so the site itself does not open.
- Adult sites are blocked by domain whichever search route is used
- Proxy and VPN sites, a common way around search rules, stay blocked
- Settings stay separate for each school or branch
SafeSearch and Restricted Mode DNS mappings
These are the hostnames the search and video services document for network enforcement. Services change, so check each one's current help pages before a rollout.
| Service | Hostnames to map | Map to | Notes |
|---|---|---|---|
| Google Search | www.google.com and the country domains your users reach | forcesafesearch.google.com | Covers web and image search. Include the local country domains as well as .com. |
| Bing | www.bing.com (and bing.com) | strict.bing.com | Results are locked to strict filtering. |
| DuckDuckGo | duckduckgo.com (and www.duckduckgo.com) | safe.duckduckgo.com | DuckDuckGo says this sets safe search to strict and disables the user's own control. |
| YouTube, Strict | www.youtube.com, m.youtube.com, youtubei.googleapis.com, youtube.googleapis.com, www.youtube-nocookie.com | restrict.youtube.com | Hides the widest range of mature videos. Suits younger students. |
| YouTube, Moderate | Same five hostnames | restrictmoderate.youtube.com | Less strict, more videos remain. Often used for older students. |
youtube.com, youtu.be or googleapis.com, because YouTube may stop working properly. Stick to the documented list.Search engines students actually use
Enforcing one engine is not enough. Students switch engines in seconds, so cover every one they can reach or block the ones you cannot lock.
The default on Chromebooks. Lock it by DNS and by Chrome policy for full coverage.
Bing
The default in some Windows browsers and assistants. Map it even if you do not use it.
DuckDuckGo
Popular with students who know about privacy settings. Supports a documented safe host.
Other engines
If an engine offers no network lock, consider blocking it so students fall back to a locked one.
AI chat tools now answer many search-style questions. They are outside SafeSearch, so set your policy for them separately; see should ChatGPT be allowed in schools and the AI tools blocklist for schools.
Alternative search and video sites in our data
If you lock one engine, students move to the next, so it helps to know how the others are labelled. The Search Engines & Platforms label shows the group together in lookups, and the sites can go on the always-block list.
| Site | Category |
|---|---|
| yandex.com | Search Engines & Platforms, Email and Messaging |
| ecosia.org | Search Engines & Platforms |
| duckduckgo.com | Search Engines & Platforms |
| brave.com | Computers & Technology |
| youtube.com | Streaming Media, Social Networking |
Google Admin settings for Chromebook SafeSearch
On managed Chromebooks, device policy follows the student everywhere, including home wifi. Use it together with DNS, not instead of it.
- In the Google Admin console, open the Chrome settings for users and browsers.
- Select the organizational unit for your students.
- Under the content settings, find the SafeSearch and Restricted Mode policy.
- Set Google Search to always use SafeSearch.
- Set the YouTube Restricted Mode level you want to enforce as a minimum.
- Save, then confirm on a test device after the policy syncs.
- Google Workspace for Education has YouTube settings that set the restriction level for signed-in users in each organizational unit.
- You can let selected staff approve specific videos that would otherwise be restricted.
- This helps teachers share useful videos that Strict mode hides.
- Menu names change over time; search the Admin console help for "control YouTube content" if a path has moved.
Windows laptops, iPads and BYOD
DNS enforcement covers every device on the school network. Off campus, each platform needs its own approach.
Windows
On campus, DNS does the work. For devices that go home, send their DNS to the school filter through your device management tool, and set browser policies for SafeSearch where your browsers support it.
iPads
Supervised iPads can be given a DNS setting or web content filter profile through mobile device management, so the same resolver applies at home. Test both Safari and installed apps.
Personal phones on school wifi
DNS enforcement works for them too, as long as they use your resolver. See BYOD filtering in schools and guest wifi filtering.
School devices at home
Without device-level settings, SafeSearch stops at the school door. Our guide to enforcing CIPA off campus covers the options.
Common SafeSearch bypass routes and fixes
When enforcement "stops working", it is almost always one of these. Close them before you blame the search engine.
Browser secure DNS
Browsers can send lookups over encrypted DNS to a public provider. Control it by browser policy on managed devices.
Public encrypted DNS
Block well-known public DNS-over-HTTPS endpoints so devices fall back to your resolver.
VPNs and proxies
Block the VPN / Proxy / Anonymizers category. See blocking proxy sites in schools.
Extensions
VPN and proxy extensions skip network rules. See blocking VPN extensions.
Country domains
Missing a country version of the search engine leaves a gap. Map every domain students can reach.
Hard-coded DNS
Devices set to a public resolver by hand. Block outbound DNS to anything but your own resolvers at the firewall.
Keeping browsers from skipping your DNS
Secure DNS settings inside a browser can send lookups around the school resolver. The hosted filter blocks public encrypted DNS and those browser settings by default, and VPN/Proxy stays blocked even when staff use a PIN.
How to test SafeSearch enforcement
Test from a real student account, not an admin one, and repeat after every change to DNS, firewall or device policy.
- Check the DNS answer. On a student device, look up the search hostname with a DNS lookup tool and confirm the answer points to the safe host or its address.
- Check the settings page. Open the engine's search settings. SafeSearch should show as on, and the switch should be locked or ignored.
- Search a harmless test term. Use a word with mixed results and compare image results with a known unfiltered device, without searching for explicit material.
- Check YouTube. Open YouTube and look for the Restricted Mode notice in the settings menu. Comments are hidden under Restricted Mode.
- Try a second browser and private window. Results should be the same if bypass routes are closed.
- Repeat on guest wifi and off campus. Take a school device home and run the same checks.
- Record it. Note the date, device and result in your CIPA file. The school web filter test can be part of the same routine.
SafeSearch trade-offs to plan for
Forced SafeSearch is low cost and high value, but it is not perfect. Knowing the trade-offs helps you set expectations with teachers.
It filters results, not sites
A student who types a site address directly is not stopped by SafeSearch. Category filtering does that job; see blocking adult content on school networks.
Strict YouTube hides good videos
Teachers will notice. Plan an approval route for videos, or use Moderate for older students. More in YouTube and streaming filtering.
No filter is complete
Search engines filter by their own rules and some explicit images still slip through. Pair SafeSearch with category blocking and supervision.
Staff may need exceptions
Use separate rules for staff networks or accounts where your policy allows, as covered in staff vs student filtering policies.
Choosing restriction levels by grade band
One setting for the whole district is simpler, but rarely right. Most districts set levels per organizational unit or network, then adjust after a term of teacher feedback.
| Group | Search engines | YouTube | Why |
|---|---|---|---|
| Elementary (K to 5) | SafeSearch forced on every engine | Strict, or YouTube blocked with teacher-shared videos only | Young students search by typing whatever they hear, and explicit image results are the main risk. |
| Middle (6 to 8) | SafeSearch forced on every engine | Strict, with video approval for teachers | Curiosity peaks and bypass attempts start. Bypass control matters most here. |
| High (9 to 12) | SafeSearch forced on every engine | Moderate, Strict where your policy prefers | Research needs widen. Moderate keeps more educational and news videos available. |
| Staff | Your policy choice | Moderate or unrestricted on staff accounts | Teachers preview material before sharing it with classes. |
| Guest wifi | SafeSearch forced | Moderate or Strict | Students often find the guest password, so treat guest networks like student networks. |
A four-step SafeSearch rollout plan
Changing DNS answers for search engines affects every user at once. A short staged rollout avoids surprises in the middle of a lesson.
Pilot
Apply the mappings to one lab or test network. Run the test routine and note anything that breaks, such as embedded videos.
Tell staff
Explain what changes, why, and how to request a video approval or report a problem. Give one contact.
Roll out
Apply to student networks first, then guest wifi, then device policy for take-home devices.
Review
After a month, collect teacher feedback, adjust levels, and record the setup in your CIPA documents.
Where SafeSearch fits with CIPA filtering
SafeSearch is one control among several. Each one covers a different way students reach unsuitable content.
Category filtering
Blocks adult, proxy and other sites by category, whatever the route to them.
SafeSearch
Removes explicit pages and images from search results before students click.
Restricted Mode
Hides mature videos on a platform too useful to block outright.
Policy and teaching
Acceptable use rules, supervision and lessons on what to do if something upsetting appears.
SafeSearch troubleshooting: symptoms and fixes
Most tickets about SafeSearch fall into a handful of patterns. This table maps what teachers report to the likely cause.
| What staff report | Likely cause | What to check |
|---|---|---|
| SafeSearch works in one browser but not another | Secure DNS turned on in the second browser | Browser policy on managed devices, and blocks on public encrypted DNS endpoints |
| Works at school, not at home | Device uses the home router's DNS | Device policy for SafeSearch, or a device link to the school filter |
| Google is locked but images still look unfiltered | A country domain or image host not mapped | Add every Google domain your users reach |
| YouTube videos will not play in a lesson | Strict mode hiding the video, or a wrongly mapped hostname | Restriction level for that group, video approval route, and the five documented hostnames only |
| Embedded videos on other sites fail | The no-cookie embed host mapped to Strict | Whether Moderate suits that group, or approval of the specific video |
| Changes not visible yet | Cached DNS answers on devices or resolvers | Wait for the cache to expire, or restart the browser and device |
| A student shows SafeSearch off | VPN, proxy extension or hotspot | Category blocks on VPN and proxy sites, extension policy, and network logs |
Keep a short log of each ticket, the cause you found and the fix. After a term, that log shows which bypass routes and settings need attention first, and it gives your next filter review real evidence to work from. Share the summary with principals too, so they know what to tell teachers who ask why a video or search result is missing.
If the pattern does not fit any row, test the same device on a known clean network. That quickly shows whether the problem is the device or the network path.
Which control handles which search problem
SafeSearch and domain blocking do different jobs, and this is how our hosted filter fits the second one.
| Problem | Result-level controls | Hosted CIPA filter |
|---|---|---|
| Explicit images in search results | Handled | Not its job; it decides by domain, not by page |
| Student opens an adult site directly | Not stopped | Adult is switched on in the CIPA preset |
| Student uses a VPN or proxy site | Not stopped | VPN/Proxy/Anonymizers blocked, even with a PIN |
| Browser secure DNS skipping the school | Needs a separate policy | Blocked by default |
| Teacher needs an adult research page | All or nothing | Staff PIN for 15, 30 or 60 minutes, then it reverts and is logged |
SafeSearch enforcement FAQ
Short answers to the questions school IT teams ask most.
How do schools force SafeSearch on every device?
With DNS: the school resolver answers lookups for each search engine with its safe address, such as forcesafesearch.google.com, strict.bing.com or safe.duckduckgo.com. On managed Chromebooks, a Google Admin policy also forces SafeSearch on and off campus.
How do I force YouTube Restricted Mode on a school network?
Point www.youtube.com, m.youtube.com, youtubei.googleapis.com, youtube.googleapis.com and www.youtube-nocookie.com to restrict.youtube.com for Strict or restrictmoderate.youtube.com for Moderate. Do not remap other hostnames.
Does forced SafeSearch make a school CIPA compliant?
No. SafeSearch filters search results, not websites. CIPA needs a technology protection measure and an internet safety policy. SafeSearch is an extra layer alongside category filtering.
Why is SafeSearch still off for some students?
Usually browser secure DNS, a public encrypted DNS service, a VPN or proxy, a cached answer, or an engine your rules do not cover. Close the bypass routes and map every engine.
Will YouTube Strict Restricted Mode block educational videos?
Some, yes. Many districts use Strict for younger students and Moderate for older ones, and use the Workspace for Education option for approved staff to approve specific videos.
How can I test that SafeSearch enforcement works?
Check the DNS answer on a student device, confirm the settings page shows SafeSearch locked on, and repeat in a second browser, on guest wifi and off campus.
More filtering guides
Pages that pair well with SafeSearch enforcement.
- CIPA DNS filter for education
- Block YouTube on school Chromebooks
- SSL inspection for schools
- Chromebook 1:1 device filtering
- Hosted CIPA filter
- Self-harm and violence content filtering
Related guides
Cost depends on how many schools and devices you have, and we send a quote within one business day. A pilot on one school makes the blocks and reports visible before you decide.
Talk to us about your district
We can help you plan DNS-level SafeSearch, YouTube restriction levels by age group and bypass control, alongside category filtering on our hosted DNS filter or your own system.
Google, Chromebook, Chrome, YouTube and Google Workspace are trademarks of Google LLC. Bing and Windows are trademarks of Microsoft Corporation. DuckDuckGo is a trademark of Duck Duck Go, Inc. iPad is a trademark of Apple Inc. They are named here only to identify the products discussed. CIPA Web Filtering is not affiliated with, sponsored or endorsed by these companies.