Safesearch inconsistently enforced

[#1]

I've created a separate ticket to https://community.plus.net/t5/Everything-else/Safeguard-not-enforcing-google-safe-search/td-p/200040... because it's marked as fixed and so I can't respond to it, but in any case I think the issue is different this time to before.

So for clarity the issue is that SafeSearch isn't force enabled in the various search engines in the way it was about a week ago.

I've investigated myself and I've noticed that if I keep re-opening the browser and attempting to search for something dodgy *sometimes* (rarely) safesearch is enforced and other times it isn't.

On a hunch I did some DNS lookups and I can see that sometimes it maps to forcesafesearch.google.com as I want:

Resolve-DnsName www.google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
www.google.com
forcesafesearch.google.com 2001:4860:4802:32::78
forcesafesearch.google.com 216.239.38.120

And most other times it does not:

Resolve-DnsName google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
google.com 2a00:1450:4009:c04::8b
google.com 2a00:1450:4009:c04::65
google.com 2a00:1450:4009:c04::66
google.com 2a00:1450:4009:c04::71
google.com 142.250.117.139
google.com 142.250.117.100
google.com 142.250.117.102
google.com 142.250.117.113
google.com 142.250.117.101
google.com 142.250.117.138

I would guess that might be an issue with the underlying BT DNS that it isn't doing this consistently, so maybe that will help at making some progress.

@bobpullen @Townman

[#2]

For stability and reliability I avoid an ISP DNS if it is capable of DNS Content Filtering or performs DNS Redirection or lacks support for DoH / DoT.

Retry the DNS lookups with Google and Cloudflare's Public DNS, see if the results are any better.

1) nslookup www.google.com 8.8.8.8
2) nslookup www.google.com 1.1.1.1

You can also check out the lookup over a wider range of Public DNS at : https://www.nslookup.io/

[#3]

Is there anyone looking into this? Until a few weeks ago this was working fine. Nothing has been changed on my end, and yet the SafeSearch feature is not often being force enabled as it was before (very rarely it is force enabled).

[#4]

@PhilipHeyes - using a third party DNS resolver is not going to help here; it would just bypass the Plusnet Safeguard enforcement of Safesearch entirely.

@CuriousSideny - I had not seen this thread as I was expecting a reply to my post elsewhere.

Are your DNS queries definitely hitting the Plusnet/BT servers each time you run them?

Perhaps you could confirm by using a command where the DNS server to be used is being explicitly specified? e.g: -

> nslookup www.google.com 213.120.234.42

In fact, might be worth trying both of the DNS IP addresses to see if there's any difference between the two?

213.120.234.38
213.120.234.42

[#5]

Thanks @bobpullen - I wasn't able to reply to the other thread for some reason - there is no option to allow me to do so.

Here are the results I get when I tried your two examples:

nslookup google.com 213.120.234.42
Server: indnsc92.bt.net
Address: 213.120.234.42

Non-authoritative answer:
Name: google.com
Addresses: 2a00:1450:4009:c17::8b
2a00:1450:4009:c17::71
2a00:1450:4009:c17::65
2a00:1450:4009:c17::64
142.251.30.139
142.251.30.113
142.251.30.101
142.251.30.102
142.251.30.138
142.251.30.100

nslookup google.com 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: google.com
Addresses: 2a00:1450:4009:c17::64
2a00:1450:4009:c17::8a
2a00:1450:4009:c17::66
2a00:1450:4009:c17::71
142.250.151.101
142.250.151.102
142.250.151.138
142.250.151.100
142.250.151.113
142.250.151.139

If I repeat with the .42 address then sometimes it says indnsc92.ukcore.bt.net and sometimes indnsc92.bt.net but no change otherwise.

[#6]

@CuriousSideny - just activated Safeguard on a Plusnet line line and given things a go.

google.com seems to do as it does for you. Using the www.google.com subdomain instead is a little more interesting.

Sometimes does what I'd expect: -

> nslookup www.google.com 213.120.234.42
Server:  indnsc92.bt.net
Address:  213.120.234.42

Non-authoritative answer:
Name:    forcesafesearch.google.com
Addresses:  2001:4860:4802:32::78
          216.239.38.120
Aliases:  www.google.com

Sometimes doesn't: -

> nslookup www.google.com 213.120.234.42
Server:  indnsc92.bt.net
Address:  213.120.234.42

Non-authoritative answer:
Name:    www.google.com
Addresses:  2a00:1450:4009:c0f::93
          2a00:1450:4009:c0f::67
          2a00:1450:4009:c0f::69
          2a00:1450:4009:c0f::68
          216.239.38.120

It's the same if I carry out a lookup against a domain I would expect to be blocked by one of the parental controls categories (dating, in this case): -

One minute blocked: -

> nslookup tms.eharmony.co.uk 213.120.234.42
Server:  indnsc92.ukcore.bt.net
Address:  213.120.234.42

Non-authoritative answer:
Name:    tms.eharmony.co.uk
Address:  81.130.111.239

The next not: -

> nslookup tms.eharmony.co.uk 213.120.234.42
Server:  indnsc92.bt.net
Address:  213.120.234.42

Non-authoritative answer:
Name:    tms.eharmony.co.uk
Addresses:  104.21.67.133
           172.67.176.232

Will see what else I can uncover. In the meatime I'd be insterested to hear if you have the same problem with a site that should be blocked by one of the category filters?

[#7]

Thanks @bobpullen: you seem to be correct that it also applies to the category domain filters too. I just brought up Chrome attempted to browse to https://www.eharmony.co.uk/ and then closed it multiple times and most of the time it blocked it, but then occasionally it browsed through to the site itself. I also repeated your experiment and got the same results as you did.

I guess I hadn't noticed that because it's only when doing an image search that I spotted the original problem.