How to Check if Safe Search is Configured on Your Device via Command Line

DNS-based Safe Search enforcement works by redirecting search engine domains (like www.google.com or www.bing.com) to specific IP addresses or CNAMEs. You can verify whether Safe Search is working on your device using the command line. This guide provides commands for Windows, macOS, and Linux.

🔍 What We’re Checking

Search engines enforce Safe Search by:

• Returning specific IP addresses when Safe Search is active
• Using CNAME records that point to enforcement domains (e.g., forcesafesearch.google.com, strict.bing.com)

When DNS-based Safe Search is working, DNS lookups for common search engine domains should return those enforcement records.

💻 Operating System Commands

Windows (PowerShell)

To check the IP addresses returned:

Resolve-DnsName www.google.com | Select-Object Name, IPAddress
Resolve-DnsName www.bing.com | Select-Object Name, IPAddress

To check CNAME chaining (to see if it’s redirected to a Safe Search hostname):

Resolve-DnsName www.google.com -Type CNAME

Example Output:

Name            IPAddress
----            ---------
www.google.com  216.239.38.120
www.bing.com    204.79.197.220

macOS (Terminal)

To check the IP addresses:

dig +short www.google.com
dig +short www.bing.com

For detailed output including CNAMEs:

dig www.google.com
dig www.bing.com

Example Output (short):

216.239.38.120

Example Output (detailed):

;; ANSWER SECTION:
www.google.com. 300 IN CNAME forcesafesearch.google.com.
forcesafesearch.google.com. 300 IN A 216.239.38.120

Linux (Terminal)

To check IP addresses:

host www.google.com
host www.bing.com

Or using dig:

dig +short www.google.com
dig +short www.bing.com

Example Output (host):

www.google.com is an alias for forcesafesearch.google.com.
forcesafesearch.google.com has address 216.239.38.120

✅ Expected Results

If Safe Search is working correctly, you should see the following values:

Domain	Safe Search Behavior	IP or CNAME Returned
www.google.com	CNAME → forcesafesearch.google.com	IPs: 216.239.38.120, 216.239.38.119
www.bing.com	CNAME → strict.bing.com	IP: 204.79.197.220
youtube.com	CNAME → restrict.youtube.com	IPs: 216.239.38.120, 216.239.38.119

If the returned IPs or CNAMEs do not match the ones listed above, Safe Search might not be active or may have been bypassed.

---

For administrators using services like CleanBrowsing, these Safe Search redirects are enforced automatically at the DNS level. If you’re seeing different results, verify your device’s DNS settings or confirm that DNS traffic is not being bypassed (e.g., via VPN or hardcoded DNS).