Verify Safe Search Configuration via Command Line

Step 1: How DNS-Based Safe Search Works

When Safe Search is enforced via DNS (as CleanBrowsing does), DNS lookups for search engines return special IP addresses or CNAME records that redirect to the safe/restricted version of the service.

For example, a lookup for www.google.com should return a CNAME pointing to forcesafesearch.google.com instead of the normal Google IP.

You can verify this using built-in command-line DNS tools on any operating system.

Step 2: Check on Windows (PowerShell)

Open PowerShell and run these commands:

Check Google Safe Search

Resolve-DnsName www.google.com | Select-Object Name, Type, IPAddress, NameHost

Check for CNAME redirect

Resolve-DnsName www.google.com -Type CNAME

Check Bing Safe Search

Resolve-DnsName www.bing.com | Select-Object Name, Type, IPAddress, NameHost

Check YouTube Restricted Mode

Resolve-DnsName www.youtube.com | Select-Object Name, Type, IPAddress, NameHost

Step 3: Check on macOS (Terminal)

Open Terminal and run:

Check Google Safe Search

dig www.google.com

Quick IP check

dig +short www.google.com

Check Bing Safe Search

dig +short www.bing.com

Check YouTube

dig +short www.youtube.com

Look for CNAME records in the ANSWER SECTION of the full dig output.

Step 4: Check on Linux (Terminal)

Use host or dig:

Using host

host www.google.com
host www.bing.com
host www.youtube.com

Using dig

dig +short www.google.com
dig +short www.bing.com

Step 5: Expected Results When Safe Search Is Active

If CleanBrowsing Safe Search enforcement is working, you should see these results: