Safe Search explained

ScoutDNS can enforce Safe Search on Google and Bing at the DNS layer. When enabled, the search engines hide adult-oriented results and block certain explicit queries entirely, including images and videos.

How it works

DNS-based Safe Search works by overriding the DNS response for Google’s and Bing’s search endpoints, pointing browsers at the “safe” variants Google and Bing host for schools and businesses. ScoutDNS doesn’t filter results in transit, Google and Bing apply the safe-results filter themselves once redirected.

Not every search engine supports this mechanism. Yahoo, DuckDuckGo, and similar engines don’t expose a “safe” DNS variant, so ScoutDNS controls them differently depending on the mode you pick.

Safe Search modes

ScoutDNS offers two modes per policy:

Mode	Google & Bing	Other search engines
On	Forced into Safe Search	Allowed (Yahoo, DuckDuckGo, etc. reachable normally)
Forced	Forced into Safe Search	Blocked entirely

Pick On when you want safer Google and Bing results without cutting off alternative engines. Pick Forced when policy requires you to channel users through only Google and Bing.

Handling broken web apps

Some web apps depend on raw, non-filtered search results to power features (e.g. an in-app search bar that queries Google). Forcing Safe Search can break those apps.

[!TIP] If an app stops working, check Activity → Logs to see which search domain the app is querying, then whitelist that specific domain in the policy. You can keep Forced mode active and selectively allow just the engines you want to permit.

If the impact is broader than a single app, drop the mode from Forced to On so non-Google/Bing engines stay reachable.