How to Enforce SafeSearch on Google, Bing & YouTube

Step 1: Why Enforce SafeSearch?

All major search engines offer SafeSearch features that filter explicit content from search results. Google has SafeSearch, Bing has Safe Search, and YouTube offers Restricted Mode. The problem is that these settings are user-controlled by default, meaning anyone can simply turn them off.

DNS-level enforcement solves this problem. By mapping search engine domains to their dedicated safe VIP addresses, all requests from your network are forced through the safe version of the search engine, regardless of what the user has configured in their browser or account settings.

There are two primary methods to enforce SafeSearch:

• Hosts file: Map search engine domains to safe IPs directly on each device. Works on Windows, Mac, and Linux.
• Router DNS mapping: Configure your router to redirect search engine domains to safe IPs, protecting all devices on the network at once.

CleanBrowsing automates this entirely. On paid plans, SafeSearch enforcement for Google, Bing, YouTube, DuckDuckGo, and other search engines is handled automatically at the DNS level. No hosts file editing or router configuration is needed. The free Family filter also enforces SafeSearch by default.

Step 2: Enforce Google SafeSearch

Google provides a special VIP address that forces SafeSearch on all Google Search requests. By mapping Google domains to this IP, every search query on your network will have SafeSearch enabled and users cannot disable it.

Google SafeSearch VIP

Method 1: Hosts File

Edit your hosts file and add the following entries. The hosts file location depends on your operating system:

• Linux / Mac: /etc/hosts
• Windows: C:\Windows\System32\drivers\etc\hosts

Add these lines to the file:

You should add entries for every Google country variant your users might access. Google maintains dozens of country-specific domains (google.co.jp, google.it, google.nl, etc.) and each one needs to be mapped individually.

Method 2: Router DNS Mapping

If your router supports DNS overrides or static host entries, you can add the same mappings at the router level. This protects every device on the network without needing to edit hosts files on each device. Check your router's DNS or DHCP settings for a "static hosts" or "DNS mapping" option.

Learn more: Configure Google SafeSearch

Step 3: Enforce Bing SafeSearch

Bing provides its own safe VIP address for forcing Safe Search on all Bing queries. The process is identical to Google: map Bing domains to the safe IP using either the hosts file or router DNS mapping.

Bing SafeSearch VIP

Domains to Map

Add the following entries to your hosts file or router DNS mapping:

The same two methods apply here:

• Hosts file: Edit /etc/hosts (Linux/Mac) or C:\Windows\System32\drivers\etc\hosts (Windows) and add the mappings above.
• Router DNS mapping: Add the same entries in your router's static hosts or DNS mapping configuration.

Learn more: Configure Bing SafeSearch

Step 4: Enforce YouTube Restricted Mode

YouTube offers two levels of Restricted Mode enforcement via DNS mapping. Unlike Google and Bing where there is a single safe VIP, YouTube provides two options depending on the level of restriction you need.

Two Restriction Levels

Domains to Map

Map the following YouTube domains to your chosen VIP address. This example uses the Strict mode VIP (216.239.38.120):

For Moderate mode, replace 216.239.38.120 with 216.239.38.119 in the entries above.

Important: The youtubei.googleapis.com and youtube.googleapis.com domains are used by the YouTube mobile app and embedded players. If you skip these, the YouTube app on phones and tablets may bypass Restricted Mode.

CleanBrowsing enforces YouTube Restricted Mode automatically on all paid plans and the free Family filter. No manual configuration is needed when using CleanBrowsing DNS.

Learn more: Enforce YouTube Restricted Mode