Safesearch inconsistently enforced

[#1]

I've created a separate ticket to https://community.plus.net/t5/Everything-else/Safeguard-not-enforcing-google-safe-search/td-p/200040... because it's marked as fixed and so I can't respond to it, but in any case I think the issue is different this time to before.

So for clarity the issue is that SafeSearch isn't force enabled in the various search engines in the way it was about a week ago.

I've investigated myself and I've noticed that if I keep re-opening the browser and attempting to search for something dodgy *sometimes* (rarely) safesearch is enforced and other times it isn't.

On a hunch I did some DNS lookups and I can see that sometimes it maps to forcesafesearch.google.com as I want:

Resolve-DnsName www.google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
www.google.com
forcesafesearch.google.com 2001:4860:4802:32::78
forcesafesearch.google.com 216.239.38.120

And most other times it does not:

Resolve-DnsName google.com | Select-Object Name, IPAddress

Name IPAddress
---- ---------
google.com 2a00:1450:4009:c04::8b
google.com 2a00:1450:4009:c04::65
google.com 2a00:1450:4009:c04::66
google.com 2a00:1450:4009:c04::71
google.com 142.250.117.139
google.com 142.250.117.100
google.com 142.250.117.102
google.com 142.250.117.113
google.com 142.250.117.101
google.com 142.250.117.138

I would guess that might be an issue with the underlying BT DNS that it isn't doing this consistently, so maybe that will help at making some progress.

@bobpullen @Townman

[#2]

For stability and reliability I avoid an ISP DNS if it is capable of DNS Content Filtering or performs DNS Redirection or lacks support for DoH / DoT.

Retry the DNS lookups with Google and Cloudflare's Public DNS, see if the results are any better.

1) nslookup www.google.com 8.8.8.8
2) nslookup www.google.com 1.1.1.1

You can also check out the lookup over a wider range of Public DNS at : https://www.nslookup.io/

[#3]

Is there anyone looking into this? Until a few weeks ago this was working fine. Nothing has been changed on my end, and yet the SafeSearch feature is not often being force enabled as it was before (very rarely it is force enabled).

[#4]

@PhilipHeyes - using a third party DNS resolver is not going to help here; it would just bypass the Plusnet Safeguard enforcement of Safesearch entirely.

@CuriousSideny - I had not seen this thread as I was expecting a reply to my post elsewhere.

Are your DNS queries definitely hitting the Plusnet/BT servers each time you run them?

Perhaps you could confirm by using a command where the DNS server to be used is being explicitly specified? e.g: -

> nslookup google.com 213.120.234.42

In fact, might be worth trying both of the DNS IP addresses to see if there's any difference between the two?

213.120.234.38
213.120.234.42

[#5]

Thanks @bobpullen - I wasn't able to reply to the other thread for some reason - there is no option to allow me to do so.

Here are the results I get when I tried your two examples:

nslookup google.com 213.120.234.42
Server: indnsc92.bt.net
Address: 213.120.234.42

Non-authoritative answer:
Name: google.com
Addresses: 2a00:1450:4009:c17::8b
2a00:1450:4009:c17::71
2a00:1450:4009:c17::65
2a00:1450:4009:c17::64
142.251.30.139
142.251.30.113
142.251.30.101
142.251.30.102
142.251.30.138
142.251.30.100

nslookup google.com 213.120.234.38
Server: indnsc102.ukcore.bt.net
Address: 213.120.234.38

Non-authoritative answer:
Name: google.com
Addresses: 2a00:1450:4009:c17::64
2a00:1450:4009:c17::8a
2a00:1450:4009:c17::66
2a00:1450:4009:c17::71
142.250.151.101
142.250.151.102
142.250.151.138
142.250.151.100
142.250.151.113
142.250.151.139

If I repeat with the .42 address then sometimes it says indnsc92.ukcore.bt.net and sometimes indnsc92.bt.net but no change otherwise.