← All guidesCanopy Families
Security guide6 min read

How to set up SafeSearch on your home network (UK)

SafeSearch can reduce explicit results from Google, Bing, and YouTube, but it is only one layer of protection. This guide explains the supported network-level options and their limits. Router settings apply only while a device uses that home network; mobile data, VPNs, encrypted DNS, other search engines, and direct website access need separate controls.

By James Mackie, Canopy Families founder · How we research and review guides

Before you start
  • DNS-based SafeSearch locking only works for searches on your home network. It does not apply when children use mobile data.
  • SafeSearch filters search results but does not block direct URL access to adult websites. Use content filtering and device controls alongside SafeSearch for broader coverage.

How DNS-based SafeSearch locking works

  1. Google and YouTube publish special hostnames that capable DNS administrators can map search and video domains to. These are destination mappings, not recursive DNS servers.
  2. Most consumer routers cannot create the required hostname mappings. A filtering DNS provider is usually the simpler home option.
  3. Canopy Families full access provides a managed NextDNS profile with SafeSearch and YouTube Restricted Mode enabled, plus guided router setup and connection checks in one parent dashboard.
This approach works at the router level. You do not need to install anything on individual devices.

Method 1 — Set up SafeSearch with Canopy Families (recommended)

  1. Start a Canopy Families full-access subscription or 14-day trial. Managed NextDNS protection is included, so you do not need to create or maintain a separate NextDNS account.
  2. Open your parent dashboard, choose Home Safety, and select your router under Router Setup.
  3. Follow the guided steps for your router. Canopy creates a family-specific filtering profile with SafeSearch, YouTube Restricted Mode, adult content, gambling, dating sites, and bypass protection enabled by default.
  4. Copy the Primary and Secondary addresses shown under Your NextDNS Servers into your router’s DNS settings, then save the router changes.
  5. Return to Home Safety → Content Blocking and select Test connection. Canopy reports protection as active only after it detects DNS traffic through the assigned profile.
  6. Review the optional blocking categories in Content Blocking, then confirm Google SafeSearch and YouTube Restricted Mode from a child device connected to your home Wi-Fi.
Canopy manages the underlying filtering profile and gives you setup status and DNS activity in the parent dashboard. Router-level protection still applies only to devices using the configured network; use the Device Setup guidance for phones and tablets away from home.

Alternative — advanced local DNS hostname mappings

Hostname mappings require ongoing administration and can be bypassed by another resolver, VPN, proxy, mobile data, or an unsupported search domain. Use device controls as well as network filtering.
  1. Use this self-managed alternative only if you already operate a router or local DNS service that supports custom CNAME or address records.
  2. Follow Google's current network-administrator instructions to map each Google search domain you support to forcesafesearch.google.com.
  3. Do not enter 216.239.38.120, or any other forced-SafeSearch destination, into a router field labelled DNS server, primary DNS, or secondary DNS.
  4. Test each hostname while connected to the protected network, then test again on mobile data so the coverage boundary is clear.

YouTube Restricted Mode for managed DNS

  1. Canopy-managed profiles enable YouTube Restricted Mode by default. Confirm the home network is active in Home Safety before testing it.
  2. For a self-managed DNS service, follow YouTube's current administrator guide and map the documented YouTube hostnames to restrict.youtube.com (strict) or restrictmoderate.youtube.com (moderate).
  3. Do not use the destination address as your router's primary or secondary DNS server.
  4. Verify from a child device on home Wi-Fi. Restricted Mode is not a complete content filter and does not apply when the device bypasses that DNS service.

Locking Bing SafeSearch

  1. Bing SafeSearch can be locked via Microsoft Family Safety (free Microsoft account required).
  2. Go to account.microsoft.com/family → Add a family member → add your child.
  3. In your child's Family Safety settings, enable Content Filters → Search.
  4. This locks Bing SafeSearch for your child's Microsoft account across all devices they are signed into.
Microsoft Family Safety also controls Xbox and Windows content — well worth setting up if your children use those platforms.

Router menus vary by model and firmware. These instructions were checked against the manufacturers' current support material; use the route shown for your exact model.

🌳

Want Canopy to manage this for you?

Canopy Families full access includes a managed NextDNS profile, guided router setup, content controls, connection checks, and a safety dashboard for your family.

Start your 14-day full-access trial