Enforcing Google Safe Search

[r43]

There have been a number of posts regarding Google Images.  Google has instructions on their site (https://support.google.com/websearch/answer/186669) (excerpt below).  Is this something OpenDNS can do as part of their DNS management or something users need to do on their end?

Thanks!

This option requires technical expertise. Options 1 and 2 are recommended for those who don’t have a technical background.

About SafeSearch Virtual IP address (VIP)

SafeSearch VIP will force all users on your network to use SafeSearch on Google Search while still allowing a secure connection via HTTPS. The VIP in SafeSearch VIP refers to a Virtual IP, which is an IP address that can be routed internally to multiple Google servers.

When SafeSearch VIP is turned on, teachers and students at your school will see a notification the first time they go to Google. This lets them know that SafeSearch is on.

Note: Using SafeSearch VIP will not affect other Google services outside of Google Search.

Turn on SafeSearch VIP

To force SafeSearch for your network, you’ll need to update your DNS configuration. Set the DNS entry for www.google.com (and any other Google ccTLD country subdomains your users may use) to be a CNAME for forcesafesearch.google.com.

We will serve SafeSearch Search and Image Search results for requests that we receive on this VIP.

[mattwilson9090]

This has been discussed many times, in multiple threads. This question is nothing new.

Bottom line, although I don't think OpenDNS has explicitly stated that they won't do this, whenever an OpenDNS employee responds to this suggestions they refer people to the Google link you included. I'm sure that, aside from legal and business considerations, part of the reason is that OpenDNS is essentially a recursive DNS service, while the directions that Google has essentially require use of an authoritative DNS server since it becomes necessary to create A records.

[rotblitz]

@r43
What you're describing has already been said at https://support.opendns.com/hc/en-us/articles/227986807

"Is this something OpenDNS can do as part of their DNS management or something users need to do on their end?"

Currently it's up to you to configure this on your end.  As mattwilson9090 said, OpenDNS have stated that such a manipulation cannot be part of recursive DNS, just of authoritative DNS.  OpenDNS is a recursive DNS service, not an authoritative one.  No matter, some other similar services have already changed their mind, so OpenDNS may follow as well.  Who knows...

[gregcanada]

I'm just a dad struggling to keep up. I'm using OpenDNS now, would like to be able to force safesearch across everything my router serves, and for that I somehow need to have my router serve as a `local DNS server' and be able to store my own DNS entries for certain domains.  I don't believe my (ISP supplied) Actiontec V1000h will do that, and it doesn't seem many of the routers on the market will either, from what I can tell. I might be wrong.

Question: How would I know if a router offered that service? What would be stated in the documentation? At least the obvious thing "search for `local DNS server' in the documentation does not seem to be bearing much fruit. Does anyone know of some specific routers that will offer that service?

Thanks in advance, G.

[mattwilson9090]

I'm not certain that any routers available to the consumer market (say $150 or less) are capable of this out of the box. There are a number of routers available on the market however that allow flashing the firmware to a third party firmware such as DD-WRT, OpenWRT, Tomato, Toastman, etc that would allow for this.

It's not especially difficult to do, but if you don't follow directions precisely you can very easily brick your router. Basically, if you aren't comfortable with the idea of swapping memory in a computer flashing router firmware probably isn't for you. If not, perhaps you can find someone local to you who is willing to do this, perhaps even for a charge.

If it were me, depending on the level of customization you need (such as forcing OpenDNS and Google SafeSearch, perhaps some other things), I'd probably charge in the range of $100 - $150, plus the cost of the router itself.

[discloser]

There are routers available which specifically allow to enforce Google SafeSearch and other restriction of this kind.

Examples: http://just.draytek.com/index.php?option=com_k2&view=item&id=5851&Itemid=293&lang=en 
                  https://www.draytek.com/index.php?option=com_k2&view=item&id=5681&Itemid=293&lang=en 
                  https://www.draytek.com/index.php?option=com_k2&view=item&id=5595&Itemid=293&lang=en

[mail11]

OpenDNS needs a better option for forcing safe search in Google and Bing and strict mode for YouTube.  The proposed solution with CNAME entries is not workable for most home users as the vast majority of home routers do not support this and most users do not have the technical knowledge for this anyway.  Without an easy, workable safe search option this service should not be offered as a "Family Shield" because it just gives parents a false sense of security.  Set up OpenDNS to block porn and then do a regular Google search for 'tits' or 'sex gif' if you need proof of this.  I switched to SafeDNS where there are simple checkboxes for safe search/strict features and it works great.  Then I just blocked the search engine category (along with a bunch of other categories).  I realize this is still not a bulletproof solution, but it is much better than I was able to get with OpenDNS.

[rotblitz]

Duplicate of https://support.opendns.com/hc/en-us/community/posts/115005887527

[worried_parent]

I agree 'mail'.  All this is useless if kids go onto Google Images - as it functions just like a porn site.  I've installed OpenDNS and just did a search 'naked girl' in Google Images  OMG

It's pointless telling me to change the settings in every browser on every device that enters our home.  Totally ineffective. 

And I must admit I can't understand half the techie jargon in these forum posts.  It's got to be easy.

[rotblitz]

See https://support.opendns.com/hc/en-us/articles/227986807

This is what Google and others have documented, not OpenDNS.  Not easy enough?  Complain with Google and whomever.  They have to do it.

OpenDNS already supports it by being able to block Search Engines and to individually block search engine domains.

[worried_parent]

So my only choice is to Blacklist Google ?!?

I don't think my Fritzbox router can do all the CNAME stuff.

[rotblitz]

Correct, with a DNS service like OpenDNS you can block domain names or categories of domain names, not any other objects like web pages, URLs, images, videos, apps, etc.

And no, a plain FRITZ!Box can't do this, but a jail-broken one can certainly do.  Its Linux OS should have a /etc/hosts file where you could configure and enforce Google SafeSearch.

[agentfr]

Qustodio does this, and for free.

[rotblitz]

Qustodio is locally running software, not a service in the cloud like OpenDNS.  You cannot compare these services.

A correct comparison would be with www.safedns.com - not for free.