topic Re: Safesearch inconsistently enforced in Everything else

Safesearch inconsistently enforced

CuriousSideny — Fri, 28 Nov 2025 22:07:56 GMT

I've created a separate ticket to https://community.plus.net/t5/Everything-else/Safeguard-not-enforcing-google-safe-search/td-p/2000409 because it's marked as fixed and so I can't respond to it, but in any case I think the issue is different this time to before.

So for clarity the issue is that SafeSearch isn't force enabled in the various search engines in the way it was about a week ago.

I've investigated myself and I've noticed that if I keep re-opening the browser and attempting to search for something dodgy *sometimes* (rarely) safesearch is enforced and other times it isn't.

On a hunch I did some DNS lookups and I can see that sometimes it maps to forcesafesearch.google.com as I want:

Resolve-DnsName www.google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
www.google.com
forcesafesearch.google.com 2001:4860:4802:32::78
forcesafesearch.google.com 216.239.38.120

And most other times it does not:

Resolve-DnsName google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
google.com 2a00:1450:4009:c04::8b
google.com 2a00:1450:4009:c04::65
google.com 2a00:1450:4009:c04::66
google.com 2a00:1450:4009:c04::71
google.com 142.250.117.139
google.com 142.250.117.100
google.com 142.250.117.102
google.com 142.250.117.113
google.com 142.250.117.101
google.com 142.250.117.138

I would guess that might be an issue with the underlying BT DNS that it isn't doing this consistently, so maybe that will help at making some progress.

@bobpullen @Townman

Re: Safesearch inconsistently enforced

PhilipHeyes — Sun, 30 Nov 2025 09:42:56 GMT

For stability and reliability I avoid an ISP DNS if it is capable of DNS Content Filtering or performs DNS Redirection or lacks support for DoH / DoT.

Retry the DNS lookups with Google and Cloudflare's Public DNS, see if the results are any better.

1) nslookup www.google.com 8.8.8.8
2) nslookup www.google.com 1.1.1.1

You can also check out the lookup over a wider range of Public DNS at : https://www.nslookup.io/

Re: Safesearch inconsistently enforced

CuriousSideny — Wed, 03 Dec 2025 23:06:25 GMT

Is there anyone looking into this? Until a few weeks ago this was working fine. Nothing has been changed on my end, and yet the SafeSearch feature is not often being force enabled as it was before (very rarely it is force enabled).

Re: Safesearch inconsistently enforced

bobpullen — Fri, 05 Dec 2025 16:05:47 GMT

@PhilipHeyes - using a third party DNS resolver is not going to help here; it would just bypass the Plusnet Safeguard enforcement of Safesearch entirely.

@CuriousSideny - I had not seen this thread as I was expecting a reply to my post elsewhere.

Are your DNS queries definitely hitting the Plusnet/BT servers each time you run them?

Perhaps you could confirm by using a command where the DNS server to be used is being explicitly specified? e.g: -

> nslookup www.google.com 213.120.234.42

In fact, might be worth trying both of the DNS IP addresses to see if there's any difference between the two?

213.120.234.38
213.120.234.42

Re: Safesearch inconsistently enforced

CuriousSideny — Thu, 04 Dec 2025 22:54:46 GMT

Thanks @bobpullen - I wasn't able to reply to the other thread for some reason - there is no option to allow me to do so.

Here are the results I get when I tried your two examples:

nslookup google.com 213.120.234.42
Server: indnsc92.bt.net
Address: 213.120.234.42

Non-authoritative answer:
Name: google.com
Addresses: 2a00:1450:4009:c17::8b
2a00:1450:4009:c17::71
2a00:1450:4009:c17::65
2a00:1450:4009:c17::64
142.251.30.139
142.251.30.113
142.251.30.101
142.251.30.102
142.251.30.138
142.251.30.100

nslookup google.com 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: google.com
Addresses: 2a00:1450:4009:c17::64
2a00:1450:4009:c17::8a
2a00:1450:4009:c17::66
2a00:1450:4009:c17::71
142.250.151.101
142.250.151.102
142.250.151.138
142.250.151.100
142.250.151.113
142.250.151.139

If I repeat with the .42 address then sometimes it says indnsc92.ukcore.bt.net and sometimes indnsc92.bt.net but no change otherwise.

Re: Safesearch inconsistently enforced

bobpullen — Fri, 05 Dec 2025 16:20:56 GMT

@CuriousSideny - just activated Safeguard on a Plusnet line line and given things a go.

google.com seems to do as it does for you. Using the www.google.com subdomain instead is a little more interesting.

Sometimes does what I'd expect: -

> nslookup www.google.com 213.120.234.42 Server: indnsc92.bt.net Address: 213.120.234.42 Non-authoritative answer: Name: forcesafesearch.google.com Addresses: 2001:4860:4802:32::78 216.239.38.120 Aliases: www.google.com

Sometimes doesn't: -

> nslookup www.google.com 213.120.234.42 Server: indnsc92.bt.net Address: 213.120.234.42 Non-authoritative answer: Name: www.google.com Addresses: 2a00:1450:4009:c0f::93 2a00:1450:4009:c0f::67 2a00:1450:4009:c0f::69 2a00:1450:4009:c0f::68 216.239.38.120

It's the same if I carry out a lookup against a domain I would expect to be blocked by one of the parental controls categories (dating, in this case): -

One minute blocked: -

> nslookup tms.eharmony.co.uk 213.120.234.42 Server: indnsc92.ukcore.bt.net Address: 213.120.234.42 Non-authoritative answer: Name: tms.eharmony.co.uk Address: 81.130.111.239

The next not: -

> nslookup tms.eharmony.co.uk 213.120.234.42 Server: indnsc92.bt.net Address: 213.120.234.42 Non-authoritative answer: Name: tms.eharmony.co.uk Addresses: 104.21.67.133 172.67.176.232

Will see what else I can uncover. In the meatime I'd be insterested to hear if you have the same problem with a site that should be blocked by one of the category filters?

Re: Safesearch inconsistently enforced

CuriousSideny — Fri, 05 Dec 2025 17:04:45 GMT

Thanks @bobpullen: you seem to be correct that it also applies to the category domain filters too. I just brought up Chrome attempted to browse to https://www.eharmony.co.uk/ and then closed it multiple times and most of the time it blocked it, but then occasionally it browsed through to the site itself. I also repeated your experiment and got the same results as you did.

I guess I hadn't noticed that because it's only when doing an image search that I spotted the original problem.

Re: Safesearch inconsistently enforced

bobpullen — Mon, 22 Dec 2025 15:23:39 GMT

@CuriousSideny just a note to say that I haven't forgotten about this one.

Re: Safesearch inconsistently enforced

CuriousSideny — Mon, 22 Dec 2025 21:55:20 GMT

I appreciate that Bob - thanks for letting me know!

Re: Safesearch inconsistently enforced

bobpullen — Mon, 05 Jan 2026 15:52:57 GMT

@CuriousSideny at the slight risk of speaking too soon, I reckon we might be in a better place now if you fancy checking things at your side?

Re: Safesearch inconsistently enforced

CuriousSideny — Wed, 07 Jan 2026 10:08:43 GMT

Hi @bobpullen,

I'm afraid I still don't see any difference in behaviour (tested against multiple devices).

Re: Safesearch inconsistently enforced

bobpullen — Thu, 08 Jan 2026 11:48:10 GMT

@CuriousSideny - hmm, that's frustrating.

So, to be clear - if you run repeated lookups to a domain you expect to be blocked, you sometimes see the 81.130.111.239 IP returned and sometimes don't? My testing was consistently returning the 81.130.111.239 IP which is what I would expect. Don't suppose you can provide some examples?

In addition, try running this a handful of times and make a note of the string that's returned (it will probably be different each time but it would be interesting to see what servers you're hitting): -

> nslookup -type=TXT -class=CHAOS id.server 213.120.234.42

You're looking for something like 'clpnd13-2'.

Re: Safesearch inconsistently enforced

Townman — Fri, 09 Jan 2026 13:09:36 GMT

@bobpullen

I am NOT using safeguarding, but get the following...

"chpnd13-1" DNS request timed out. timeout was 2 seconds. Non-authoritative answer: id.server text = "chpnd11-4" "chpnd15-2" "chpnd15-2" "chpnd12-3" "chpnd11-4" "chpnd14-1" "chpnd12-3" "chpnd15-2" "chpnd13-1" "chpnd14-1" "chpnd12-3"

Does this help any? I chopped out all of the guff (aside from the DNS time out response). Let me know if more detailed querying would help and I'll try to set up some automation.

Are you aware of the incident which is impacting the administration of safeguarding settings?

Re: Safesearch inconsistently enforced

CuriousSideny — Fri, 09 Jan 2026 16:28:50 GMT

Thanks @bobpullen (and @Townman for your info). I ran this in a loop for 2 mins and got the following (the number at the start is the number of times that result came up):

516 : Server: indnsc92.bt.net Address: 213.120.234.42 id.server text = "chpnd12-3"
502 : Server: indnsc92.bt.net Address: 213.120.234.42 id.server text = "chpnd15-2"
486 : Server: indnsc92.bt.net Address: 213.120.234.42 id.server text = "chpnd11-4"
468 : Server: indnsc92.bt.net Address: 213.120.234.42 id.server text = "chpnd13-1"
424 : Server: indnsc92.bt.net Address: 213.120.234.42 id.server text = "chpnd14-1"
120 : Server: indnsc92.ukcore.bt.net Address: 213.120.234.42 id.server text = "chpnd15-2"
109 : Server: indnsc92.ukcore.bt.net Address: 213.120.234.42 id.server text = "chpnd13-1"
108 : Server: indnsc92.ukcore.bt.net Address: 213.120.234.42 id.server text = "chpnd14-1"
100 : Server: indnsc92.ukcore.bt.net Address: 213.120.234.42 id.server text = "chpnd11-4"
83 : Server: indnsc92.ukcore.bt.net Address: 213.120.234.42 id.server text = "chpnd12-3"

Re: Safesearch inconsistently enforced

CuriousSideny — Fri, 09 Jan 2026 17:06:19 GMT

I performed some more DNS resolving and see examples as follows.

Result which seems to correctly redirect to forcesafesearch.google.com:

Resolve-DnsName www.google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
www.google.com
forcesafesearch.google.com 2001:4860:4802:32::78
forcesafesearch.google.com 216.239.38.120

Result which seems to incorrectly redirect at least for Ipv4 addresses:

Resolve-DnsName www.google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
www.google.com
forcesafesearch.google.com 2001:4860:4802:32::78
www.google.com 192.178.223.147
www.google.com 192.178.223.104
www.google.com 192.178.223.106
www.google.com 192.178.223.99
www.google.com 192.178.223.105
www.google.com 192.178.223.103

And:

Resolve-DnsName www.google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
www.google.com 2a00:1450:4009:c0f::63
www.google.com 2a00:1450:4009:c0f::6a
www.google.com 2a00:1450:4009:c0f::68
www.google.com 2a00:1450:4009:c0f::93
forcesafesearch.google.com 216.239.38.120

Re: Safesearch inconsistently enforced

bobpullen — Sat, 10 Jan 2026 15:25:01 GMT

@CuriousSideny - thanks, seems you're hitting the same servers/data centres as me so I'm unsure why I'm not seeing what you are 🤔

With the lookups, could you modify the command to specify the DNS server address so we know for sure that's what it's hitting (or just use the nslookup command I suggested)?

@Townman - no, not aware. Is it the error banner that pops when modifying settings? I was seeing that myself when trying to replicate this issue and assumed it was something specific to my account.

Re: Safesearch inconsistently enforced

CuriousSideny — Sat, 10 Jan 2026 18:35:48 GMT

Hi Bob,

In my first response I was using the same command you specified to capture them:

"nslookup -type=TXT -class=CHAOS id.server 213.120.234.42"

Is that okay or do you want me to try something else?

Thanks!

Re: Safesearch inconsistently enforced

HPsauce — Sat, 10 Jan 2026 18:56:10 GMT

I don't know if it's relevant but I've seen some really weird Safesearch behaviour in recent weeks.

In Google searches I would notice that it had been turned on and that there was a message saying I couldn't turn it off as it was enforced externally via an administrator (wording guessed from poor memory).

Yet closing the browser (usually Edge) and reopening it would remove Safesearch.

After the recent DNS problems I changed away from router (Hub2) i.e. PN-supplied DNS to independent services. This weirdness no longer happens. It's consistently off as my Google accounts specifies.

The interesting thing here is NOT ONLY that Safesearch was inconsistent BUT it was being imposed when NOT ASKED FOR!

Not sure which is worse, censorship you've not asked for or censorship that is inconsistent........

Re: Safesearch inconsistently enforced

bobpullen — Sat, 10 Jan 2026 19:49:50 GMT

@HPsauce - thanks for sharing your experience. Those symptoms are exactly what we're trying to get to the bottom of.

@CuriousSideny - it's the website (or Google Safesearch) lookups that would be handy rather than the server ID ones. i.e: -

> nslookup pof.com 213.120.234.42

Above assumes that you have dating websites blocked. Substitute pof.com for another website that falls into a category you do have blocked if not.

Specifying the Safeguard DNS server address just removes any ambiguity around what DNS server is replying to your lookups.

Re: Safesearch inconsistently enforced

HPsauce — Sat, 10 Jan 2026 20:31:29 GMT

Thanks @bobpullen but unfortunately I can't really give you any more useful information. I must say I did find it really quite weird and inexplicable.

As a retired IT guy I could probably have given more detailed analysis with a bit of effort but it wasn't a significant annoyance to me and I've now bypassed it.