← All guidesCanopy Families
Security guide6 min read

How to set up SafeSearch on your home network (UK, 2025)

SafeSearch filters explicit images and content from Google, Bing, and YouTube search results. The problem is that it can be turned off in seconds by any child who knows where to look. This guide shows how to lock SafeSearch at the network level using DNS — so it applies to every device in your home, whether it is a phone, laptop, games console, or smart TV, and cannot be turned off without your Wi-Fi password.

Before you start
  • DNS-based SafeSearch locking only works for searches on your home network. It does not apply when children use mobile data.
  • SafeSearch filters search results but does not block direct URL access to adult websites. Use content filtering (NextDNS) alongside SafeSearch for full protection.

How DNS-based SafeSearch locking works

  1. Google, Bing, and YouTube offer "forced SafeSearch" DNS endpoints — special IP addresses that automatically return SafeSearch-enabled results.
  2. By pointing your router's DNS to these IPs, every device on your network receives SafeSearch results automatically.
  3. NextDNS provides an easy toggle to enable forced SafeSearch across all major search engines from a single dashboard.
This approach works at the router level. You do not need to install anything on individual devices.

Method 1 — Enable SafeSearch via NextDNS (recommended)

  1. Create a free account at nextdns.io.
  2. In your NextDNS dashboard, click Privacy → SafeSearch.
  3. Toggle on Google SafeSearch, Bing SafeSearch, and YouTube Restricted Mode.
  4. Note your NextDNS Profile ID.
  5. Set your router's primary DNS to 45.90.28.159 and secondary DNS to 45.90.30.159 (see the guide for your specific router above). Note: if you're a Canopy Pro member, use your personalised DNS addresses from your Safety dashboard instead.
  6. Test by opening an incognito browser window and searching for explicit terms on Google — results should be filtered and a SafeSearch indicator should appear.

Method 2 — Use Google's forced SafeSearch DNS directly

Google's forced SafeSearch IP is not encrypted (plain DNS), which means it can be bypassed by a device that uses its own DNS. NextDNS with DoH is the more robust option.
  1. Set your router's primary DNS to 216.239.38.120 (Google SafeSearch forced endpoint).
  2. This forces Google.co.uk and Google.com to return SafeSearch results for every device on your network.
  3. Note: this only covers Google. You will need a separate approach for Bing and YouTube.

Lock YouTube Restricted Mode via DNS

  1. Set your router's primary DNS to 216.239.38.119 (YouTube Restricted Mode forced endpoint).
  2. Alternatively, use NextDNS with YouTube Restricted Mode enabled — this is simpler if you are already using NextDNS.
  3. To verify: open YouTube and check for the Restricted Mode indicator in the footer (scroll to the bottom of the YouTube homepage).

Locking Bing SafeSearch

  1. Bing SafeSearch can be locked via Microsoft Family Safety (free Microsoft account required).
  2. Go to account.microsoft.com/family → Add a family member → add your child.
  3. In your child's Family Safety settings, enable Content Filters → Search.
  4. This locks Bing SafeSearch for your child's Microsoft account across all devices they are signed into.
Microsoft Family Safety also controls Xbox and Windows content — well worth setting up if your children use those platforms.
🌳

Want Canopy to manage this for you?

Canopy Families guides parents through every security step — DNS setup, device controls, and content filtering — and keeps your protection up to date as your children grow.

Start free — takes 5 minutes