Can my child turn safe search back off?

Not from the device. The browser’s own safe search toggle stops mattering, because the DNS resolver tells the search engine to enforce safe search filters before the browser is involved. The only way to disable it is to change the DNS settings for the device or network.

Does this cover apps, or only browsers?

Both, for the search engines themselves. The filtering is enforced because of how the device looks up the address for the site, so the Google or YouTube will be filtered whether access by app or browser.

Will it break Gmail, Drive or Yahoo Mail?

No. Safe search redirects the search hostnames only — for example, search.yahoo.com rather than yahoo.com, so Yahoo Mail keeps working.

What is the difference between YouTube’s Moderate and Strict modes?

They are YouTube’s own Restricted Mode settings. Moderate hides most mature content while leaving the bulk of the catalogue reachable; Strict is considerably tighter and will hide things that are considered borderline. Strict is the usual choice for younger children, Moderate for teenagers, and either is enforced the same way.

Can I have it on for the children and off for me?

Yes, and that is the usual arrangement. Safe search is a per-profile setting, and can configure a DNS profile on the network or a particular device - it is your choice. So, a child tablet can be strict while your laptop is untouched.

Can it be on only during certain hours?

Yes. A DNS rule schedule swaps a profile’s whole policy by time of day and day of week, including safe search settings.

Does it work when they leave the house?

Only if the setting is on the device rather than or in addition to being on your home router. Android’s Private DNS and an Apple configuration profile both stay in force inside and outside the home; but, a router setting stops at your front door. For devices that leave the home, set it on the device itself.

Guide

Enforce safe search on every device

Safe search inside a browser is a request. Enforced at the DNS layer it is a rule — it covers the console and the television, it survives a new browser and a private window, and it cannot be switched off from the device it applies to.

The short version

6 engines: Google, Bing, DuckDuckGo, Brave, Yandex and Pixabay held in safe mode
2 modes: YouTube’s Moderate or Strict restricted mode, whichever you choose
200 more: search sites with no safe mode, blocked outright if you want them gone
Can’t be bypassed: from inside the browser — the setting is not on the device

Why the setting in the browser keeps coming undone

Every search engine has a safe mode, and every one of them keeps that setting where the person searching can reach it: in the browser, per device, per engine, and often per profile within the browser. It holds until someone clears their settings, opens a different browser, uses a private window, or simply turns it off.

Enforcing it at the DNS layer moves the setting somewhere else entirely. When a device looks up google.com, the DNS resolver answers with Google’s own SafeSearch address instead of the ordinary one. The search engine does the filtering, as it always did — what changes is that the answer arrives before the browser has any say, so the toggle inside it stops mattering.

What to look for	Enforced at the DNS layer	Set inside the browser
Where the setting lives	On the DNS resolver that tells the device what to connect to	In each browser, on each device, per search engine
Who can switch it off	Whoever controls the DeCloudUs account	Anyone using the device, in about four clicks
A new browser, or a private window	Covered — the setting is enforced regardless of browsing window changes	Starts unfiltered until someone sets it up again
A console, tablet or TV you cannot install anything on	Yes	Usually not
A guest or a hand-me-down device joining the network	Covered the moment it connects to your network (assuming DNS profile is configured on your network)	Not until someone configures it
Different rules for different people	Different DNS profiles as you need — the child’s tablet strict, your laptop untouched	Whatever each device happens to be set to
Changing by time of day	A DNS rule schedule can carry its own safe search settings	Usually not
Effort to keep it that way	Set it and forget it	Re-checked on every device, forever

Where the setting lives

Enforced at the DNS layer: On the DNS resolver that tells the device what to connect to
Set inside the browser: In each browser, on each device, per search engine

Who can switch it off

Enforced at the DNS layer: Whoever controls the DeCloudUs account
Set inside the browser: Anyone using the device, in about four clicks

A new browser, or a private window

Enforced at the DNS layer: Covered — the setting is enforced regardless of browsing window changes
Set inside the browser: Starts unfiltered until someone sets it up again

A console, tablet or TV you cannot install anything on

Enforced at the DNS layer: Yes
Set inside the browser: Usually not

A guest or a hand-me-down device joining the network

Enforced at the DNS layer: Covered the moment it connects to your network (assuming DNS profile is configured on your network)
Set inside the browser: Not until someone configures it

Different rules for different people

Enforced at the DNS layer: Different DNS profiles as you need — the child’s tablet strict, your laptop untouched
Set inside the browser: Whatever each device happens to be set to

Changing by time of day

Enforced at the DNS layer: A DNS rule schedule can carry its own safe search settings
Set inside the browser: Usually not

Effort to keep it that way

Enforced at the DNS layer: Set it and forget it
Set inside the browser: Re-checked on every device, forever

Both rely on the search engine's own safe mode. The difference is only who gets to decide whether it is on — which, in a house with children in it, is the entire difference.

What you can hold in safe mode

Google

Search, Images and News return SafeSearch-filtered results on every Google country domain, and it cannot be switched off in Google’s own settings. Gmail, Drive and Docs are untouched.

Bing

Strict SafeSearch, which filters adult text, images and video from results.

DuckDuckGo

Strict safe search, including the HTML and Lite versions people use to get around filters.

Brave Search

Strict safe search.

Yandex

Family mode on its main country domains.

Pixabay

SafeSearch on image search, which hides images unsuitable for children.

Each is a separate switch, so a household that only cares about Google is not forced to take the rest.

YouTube, and the two ways to restrict it

Moderate

YouTube’s own Restricted Mode at its lighter setting. Hides most mature content and leaves the bulk of the catalogue reachable. The usual choice for teenagers.

Strict

Considerably tighter, and it will hide things that are merely borderline. The usual choice for younger children, and the one to start with if you are unsure.

Either applies to the YouTube app as well as the site, because both have to look up the same addresses.

The engines that have no safe mode at all

Some search sites offer no filtered mode, so there is nothing to enforce — and they are exactly what turns up once the main engines stop returning what someone was looking for. You can block them instead: 200 search hostnames, including Yahoo, Ecosia, Startpage and a long tail of metasearch sites and Searx instances.

Search hostnames only, never a company’s whole domain. It blocks search.yahoo.com and leaves yahoo.com alone, so Yahoo Mail keeps working. Filtering a search engine is not a reason to take someone’s email away.

Turning it on

Create a profile for the device. Create a profile in the DeCloudUs dashboard for the device or the person the rules are for. Each DNS profile has its unique DNS address.
Turn on the engines you want safe search for. On the profile’s Safe Search tab, switch on the search engines to enforce, choose YouTube’s Moderate or Strict mode, and decide whether to block engines that have no safe mode.
Point the device at the profile. Set the profile hostname as the device’s DNS, and/or on the router to cover everything on the network at once.
Close the ways around it. Turn on the Filter Bypass category to block public VPN, proxy and DNS-over-HTTPS services, and lock the device’s network settings so the DNS entry cannot simply be removed.

The dashboard shows each engine as its own toggle with the exact hostname it will be answered with, so you can see what the setting does before you rely on it. The setup guide covers pointing a device or a router at the profile.

Closing the ways around it

The browser’s own DNS

Chrome and Firefox each carry a secure DNS setting that overrides the device’s. The Filter Bypass category blocks the providers they can be pointed at.

A free VPN app

Thirty seconds to install and it routes around everything. The same category blocks the public VPN and proxy services those apps rely on.

Changing DNS settings

Lock network and/or settings so the DNS entry cannot simply be removed.

Frequently asked

Can my child turn safe search back off?: Not from the device. The browser’s own safe search toggle stops mattering, because the DNS resolver tells the search engine to enforce safe search filters before the browser is involved. The only way to disable it is to change the DNS settings for the device or network.
Does this cover apps, or only browsers?: Both, for the search engines themselves. The filtering is enforced because of how the device looks up the address for the site, so the Google or YouTube will be filtered whether access by app or browser.
Will it break Gmail, Drive or Yahoo Mail?: No. Safe search redirects the search hostnames only — for example, search.yahoo.com rather than yahoo.com, so Yahoo Mail keeps working.
What is the difference between YouTube’s Moderate and Strict modes?: They are YouTube’s own Restricted Mode settings. Moderate hides most mature content while leaving the bulk of the catalogue reachable; Strict is considerably tighter and will hide things that are considered borderline. Strict is the usual choice for younger children, Moderate for teenagers, and either is enforced the same way.
What happens with search engines that have no safe mode?: Some engines offer no filtered mode at all, so there is nothing to enforce. You can block them instead with one click — 200 search hostnames, including Yahoo, Ecosia, Startpage and a long tail of metasearch and Searx instances, which are what a curious teenager finds after the main engines stop returning what they wanted.
Can I have it on for the children and off for me?: Yes, and that is the usual arrangement. Safe search is a per-profile setting, and can configure a DNS profile on the network or a particular device - it is your choice. So, a child tablet can be strict while your laptop is untouched.
Can it be on only during certain hours?: Yes. A DNS rule schedule swaps a profile’s whole policy by time of day and day of week, including safe search settings.
Does it work when they leave the house?: Only if the setting is on the device rather than or in addition to being on your home router. Android’s Private DNS and an Apple configuration profile both stay in force inside and outside the home; but, a router setting stops at your front door. For devices that leave the home, set it on the device itself.

Where this fits

Safe search is one part of a larger arrangement. The parental controls guide covers the rest of it — per-child profiles, blocking apps by name, schedules, etc.

Set up a device