SafeSearch Enforcement Issue on Mobile Devices

Requirement
The enforcement is working correctly on laptops with both the web filter and DNS filter enabled. However, on mobile devices, the Chrome browser loads the homepage initially, but subsequent pages are blocked. The expected behavior is that SafeSearch should be enforced right from the homepage, ensuring that even the homepage loads through the enforced SafeSearch..

Use case: College, School

Step-1
Create the loopback interface for enforcing DNS.
Note: The IP address should not be configured anywhere else.



Step 2: Enable the DNS Database under Feature Visibility.



Step 3: Block the P**ography category in the Web Filter and enable SafeSearch.

Step 4: Block the P**ography category in the DNS Filter as well, and enable Enforce SafeSearch.

Step 5: For the DNS-Loopback interface, enable the DNS Filter and set the mode to Recursive.

Step 6: Create the DNS entry for SafeSearch-Google.
I.II.

CLI commands for creating the DNS entry to enforce SafeSearch

config system dns-database

    edit "SafeSearch-Google"

        set domain "google.com"

        set authoritative disable

        config dns-entry

            edit 1

                set type CNAME

                set hostname "www"

                set canonical-name "forcesafesearch.google.com"

            next

        end

    next

    edit "google.com"

        set domain "google.cat"

        set authoritative disable

        config dns-entry

            edit 1

                set hostname "www"

                set ip 216.239.38.120

            next

        end

    next

end



Step 7: Policy Creation

You need to assign the DNS server IP as the Loopback interface IP to the devices. Then, create a DNS allow policy above the internet policy. Make sure that NAT is disabled for the DNS service.

Results:

The Result will be enabled the Enforce search by default to all browsers as mentioned below Screenshot.

DNS filter Logs: