Overview
Note:
This solution is provided 'as is' and is an implementation that has been provided by Google. OpenDNS is unable to support this solution directly as it does not involve any OpenDNS software.
Currently, enforcing Google SafeSearch, YouTube, or Bing on your network without an HTTP proxy requires the ability to create a local Canonical Name (CNAME) record on your local DNS server or editing your Hosts file on your local computer.
For a possible Bing solution, scroll down below.
The Global enforcement of Google SafeSearch previously was only possible with a local agent or firewall rules; however, Google has introduced a new way of enforcing SafeSearch with Google SafeSearch VIP. This may change in the future; however, at this time it requires the creation of a new CNAME record locally. For more information, please consult Option 3 at this Google article. Note that this will not affect any other Google services other than Search and Image Search. Due to the large variation in DNS servers, we are not able to directly support the implementation of this local CNAME record at this time.
Source Articles:
Google SafeSearch
YouTube (Option 1: DNS)
Bing Search
Google SafeSearch
To configure this, please follow these steps:
1. Add a new CNAME record on your local DNS server for your local Google domain(s) pointing to forcesafesearch.google.com. For this example, we will be using www.google.com. Create a CNAME record for www.google.com that points to forcesafesearch.google.com.
2. Clear your DNS cache of the saved www.google.com record.
3. Make a new search and you should be prompted that SafeSearch is enabled. As long as this CNAME record is in place, SafeSearch will be enforced on the network.
An example configuration on Windows Server 2012 can be seen below for the A-Record equivalent. For the CNAME, create a CNAME record pointing www.google.com to forcesafesearch.google.com.
You may need to add a www.google.com zone and provide an A record override for www.google.com to 216.239.38.120 (forcesafesearch.google.com) depending on your DNS server setup.
**If you have a Virtual Appliance or Roaming Clients, you must also add www.google.com to the internal domains list**
That's it. Your network is now configured to enforce SafeSearch for all computers utilizing your local DNS server. To confirm it's active, the first time you visit google.com, a message will appear on the top of the screen confirming SafeSearch is force enabled.
Using a Hosts file? Edit in the below line:
216.239.38.120 www.google.com #forcesafesearch
To confirm it is working, look for the banner shown on the below image.
And SafeSearch will be enforced for adult content that is filtered by Google Search.
Bing Family Filter
Bing offers a CNAME-based Family Filter equivalent as well as a system for schools to register their IP addresses for Bing to enforce Family Filter on the server-side. For more information, please refer to https://www.bing.com/classroom/registration.
For the CNAME equivalent, use the Google steps above; however, point www.bing.com to strict.bing.com.
Youtube
For youtube, add a CNAME for the following records:
- www.youtube.com
- m.youtube.com
- youtubei.googleapis.com
- youtube.googleapis.com
- www.youtube-nocookie.com
And point them to:
For Strict Restricted YouTube access, add restrict.youtube.com as a CNAME for these domains. For Moderate Restricted YouTube access, add restrictmoderate.youtube.com as a CNAME for these domains.