← All guidesCanopy Families
Security guide6 min read

How to set up SafeSearch on your home network (UK)

SafeSearch can reduce explicit results from Google, Bing, and YouTube, but it is only one layer of protection. This guide explains the supported network-level options and their limits. Router settings apply only while a device uses that home network; mobile data, VPNs, encrypted DNS, other search engines, and direct website access need separate controls.

By James Mackie, Canopy Families founder · How we research and review guides

Before you start
  • SafeSearch enforced only by your home-router DNS route does not follow a device onto mobile data or another Wi-Fi network. Separately configured device or account controls may still apply.
  • SafeSearch filters search results but does not block direct URL access to adult websites. Use content filtering and device controls alongside SafeSearch for broader coverage.

How DNS-based SafeSearch locking works

  1. Google and YouTube publish special hostnames that capable DNS administrators can map search and video domains to. These are destination mappings, not recursive DNS servers.
  2. Most consumer routers cannot create the required hostname mappings. A filtering DNS provider is usually the simpler home option.
  3. Canopy Families full access provides a managed NextDNS profile with SafeSearch and YouTube Restricted Mode enabled, plus guided router setup and connection checks in one parent dashboard.
A supported router-level DNS setup can serve devices that use its DNS route. Other devices or connections may need their own setup and check.

Method 1 — Set up SafeSearch with Canopy Families (recommended)

  1. Start a Canopy Families full-access subscription or 14-day trial. Managed NextDNS protection is included, so you do not need to create or maintain a separate NextDNS account.
  2. Open your parent dashboard, choose Home Safety, and select your router under Router Setup.
  3. Canopy creates a family-specific filtering profile with SafeSearch, YouTube Restricted Mode, and required blocking categories. Follow only a verified DNS setup method supported for your exact router; Device Setup does not install this profile on a phone.
  4. If Home Safety displays a validated pair of family-specific IPv4 addresses and your router has a confirmed custom DNS-server menu, enter those addresses there. Otherwise review separate device and mobile-provider controls or ask for help; this guide does not provide a verified Canopy mobile-DNS setup.
  5. Return to Home Safety → Content Blocking and select Check profile traffic. A positive check means at least one recent request used the family profile; it does not prove that every device is covered.
  6. Review the optional blocking categories in Content Blocking, then confirm Google SafeSearch and YouTube Restricted Mode from a child device connected to your home Wi-Fi.
Canopy manages the underlying filtering profile and shows profile-level DNS activity in the parent dashboard. Router-level setup does not follow a phone onto mobile data. Device Setup covers Screen Time and Family Link; those controls do not connect a phone to Canopy DNS. Check your mobile provider’s content-filter options too.

Alternative — advanced local DNS hostname mappings

Hostname mappings require ongoing administration and can be bypassed by another resolver, VPN, proxy, mobile data, or an unsupported search domain. Use device controls as well as network filtering.
  1. Use this self-managed alternative only if you already operate a router or local DNS service that supports custom CNAME or address records.
  2. Follow Google's current network-administrator instructions to map each Google search domain you support to forcesafesearch.google.com.
  3. Do not enter 216.239.38.120, or any other forced-SafeSearch destination, into a router field labelled DNS server, primary DNS, or secondary DNS.
  4. Test each hostname while connected to the protected network, then test again on mobile data so the coverage boundary is clear.

YouTube Restricted Mode for managed DNS

  1. Canopy-managed profiles enable YouTube Restricted Mode by default. Check for recent profile traffic in Home Safety, then test the setting on the specific device and connection you want to assess.
  2. For a self-managed DNS service, follow YouTube's current administrator guide and map the documented YouTube hostnames to restrict.youtube.com (strict) or restrictmoderate.youtube.com (moderate).
  3. Do not use the destination address as your router's primary or secondary DNS server.
  4. Verify from a child device on home Wi-Fi. Restricted Mode is not a complete content filter and does not apply when the device bypasses that DNS service.

Locking Bing SafeSearch

  1. Bing SafeSearch can be locked via Microsoft Family Safety (free Microsoft account required).
  2. Go to account.microsoft.com/family → Add a family member → add your child.
  3. Select the child in Family Safety, open the Edge platform settings, and enable Filter inappropriate websites and searches.
  4. Use a supported browser (currently Microsoft Edge) with the child signed into the supervised Microsoft account. Family Safety web and search filtering does not apply to every browser.
  5. Check the Bing filtering result on each device and browser your child uses; signing in to a Microsoft account alone does not verify every search path.
Microsoft Family Safety also controls Xbox and Windows content — well worth setting up if your children use those platforms.

The sources below informed this editorial review. Router menus and service features vary by model, firmware and account. A documentation check is not a hardware test or confirmation of Canopy support.

Explore Canopy Families

Full access includes a managed NextDNS profile and parent dashboard. Filtering needs an available setup method validated for your exact router; a profile traffic check does not confirm every device or mobile connection.

£9.99/month after an eligible 14-day trial. A payment card is required at checkout; the paid subscription starts after the trial unless you cancel. A limited free plan is also available: five sessions per week and one child profile, without managed NextDNS filtering.

Create an account to choose your plan