Enable SafeSearch on a DNS Security profile to enforce safe search and YouTube content restrictions at the DNS layer without decrypting traffic.
| Where Can I Use
This? | What Do I Need? |
|---|
SafeSearch is a feature on internet search engines that filters explicit and inappropriate content from search results. When you enable SafeSearch on a DNS Security profile, the Advanced DNS Security Resolver automatically rewrites DNS queries for supported search engines to their SafeSearch-enforced domains (for example, google.com to forcesafesearch.google.com). This enforcement occurs at the DNS resolution stage, so it applies to all users on your network without requiring per-device browser configuration or traffic decryption.
The following search engines are supported:
For YouTube, you can configure a separate restrict mode that controls the degree of content filtering:
When SafeSearch is enabled, the resolver evaluates policies in the following order:
- Internal Domains
- Custom Domain Groups (if the queried domain appears in a custom domain group, SafeSearch rewrite is skipped)
- External Dynamic Lists (if the queried domain appears in an EDL, SafeSearch rewrite is skipped)
- SafeSearch rewrite
- Category action through Inspection Service (if you set the search-engines or streaming-media category to sinkhole or block, the category action takes precedence over SafeSearch)
SafeSearch supports A and AAAA DNS record types only.
