https://live.paloaltonetworks.com/t5/general-articles/introducing-safe-search-for-the-advanced-dns-security-resolver/ta-p/1261322 <DIV class="lia-message-template-content-zone"> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Security Resolver.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/72213iFB6A6D6475B3EC43/image-size/large?v=v2&amp;px=999" role="button" title="Security Resolver.png" alt="Security Resolver.png" /></span></P> <P>&nbsp;</P> <P><SPAN>For network administrators, securing web traffic is a delicate balancing act between safety, privacy, and performance. This challenge is especially acute in educational institutions and enterprise environments enforcing strict workplace content policies.</SPAN></P> <P><SPAN>Historically, enforcing SafeSearch across major search engines forced administrators into frustrating trade-offs:</SPAN></P> <P>&nbsp;</P> <UL> <LI style="font-weight: 400;" aria-level="1"><SPAN>Decryption Friction: SSL/TLS decryption allows deep inspection, but data privacy regulations and BYOD (Bring Your Own Device) environments make full-scale decryption legally complex or technically non-viable.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>Operational Overhead: Using traditional DNS proxies requires constant manual tracking of dynamic SafeSearch IP addresses—a maintenance headache that degrades over time.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>Local Bypasses: Relying on browser-level settings or endpoint management fails the moment an unmanaged personal device connects to the network.</SPAN></LI> </UL> <P>&nbsp;</P> <P><SPAN>Today, we are eliminating these trade-offs. We are excited to announce native SafeSearch enforcement built directly into the Palo Alto Networks Advanced DNS Security Resolver (ADNSR).</SPAN></P> <H2><I><SPAN>&nbsp;</SPAN></I></H2> <H2><STRONG>How It Works: Safety at the DNS Level&nbsp;</STRONG></H2> <P><SPAN><BR /></SPAN><SPAN>Instead of waiting for HTTP/HTTPS content inspection or relying on endpoint configuration, the Advanced DNS Security Resolver intercepts and rewrites DNS queries for supported search engines directly at the resolution stage.</SPAN></P> <P>&nbsp;</P> <P><SPAN>When a user on your network attempts to access a search engine, ADNSR automatically resolves the domain to its SafeSearch-enforced target (evaluating both A and AAAA record types). Supported search engines include:</SPAN></P> <P>&nbsp;</P> <UL> <LI style="font-weight: 400;" aria-level="1"><STRONG>Google</STRONG></LI> <LI style="font-weight: 400;" aria-level="1"><STRONG>Bing</STRONG></LI> <LI style="font-weight: 400;" aria-level="1"><STRONG>YouTube</STRONG></LI> <LI style="font-weight: 400;" aria-level="1"><STRONG>DuckDuckGo</STRONG></LI> <LI style="font-weight: 400;" aria-level="1"><STRONG>Yandex</STRONG></LI> <LI style="font-weight: 400;" aria-level="1"><STRONG>Brave</STRONG></LI> </UL> <P>&nbsp;</P> <P><SPAN>Because enforcement occurs at the DNS layer before a connection is established, explicit content, thumbnails, and harmful search results are blocked automatically—without requiring traffic decryption or per-device management.</SPAN></P> <P>&nbsp;</P> <H2><STRONG>Getting Started</STRONG><STRONG>&nbsp;</STRONG></H2> <P><SPAN><BR /></SPAN><SPAN>Enabling SafeSearch across your entire network takes less than two minutes:</SPAN></P> <P>&nbsp;</P> <OL> <LI style="font-weight: 400;" aria-level="1"><SPAN>Log in to Strata Cloud Manager.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>Navigate to </SPAN><STRONG>Configuration</STRONG><SPAN>, select </SPAN><STRONG>ADNS Resolver</STRONG><SPAN>, then select the </SPAN><STRONG>DNS Security Profiles</STRONG><SPAN> tab.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>Select an existing DNS Security profile or create a new one.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>Select the Safe Search tab.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>Enable Safe Search. Once enabled, the Advanced DNS Security Resolver automatically rewrites DNS queries for supported search engines to their SafeSearch-enforced domains. (Note: Google, Bing, Brave, DuckDuckGo, and Yandex are enforced collectively and cannot be enabled individually.)</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>(Optional) Configure </SPAN><STRONG>Restrict YouTube Access</STRONG><SPAN> and select your preferred </SPAN><STRONG>Filtering Level</STRONG><SPAN>.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>Save the DNS Security profile configuration.</SPAN></LI> </OL> <P>&nbsp;</P> <P><SPAN>By shifting SafeSearch enforcement to the Advanced DNS Security Resolver, you get instant coverage, complete privacy compliance, and zero endpoint overhead.</SPAN></P> <P>&nbsp;</P> <P><I><SPAN>Update your DNS Security profiles today to take advantage of effortless, network-wide SafeSearch enforcement.</SPAN></I></P> </DIV> Fri, 07 Aug 2026 08:29:18 GMT nfish 2026-08-07T08:29:18Z https://live.paloaltonetworks.com/t5/general-articles/introducing-safe-search-for-the-advanced-dns-security-resolver/ta-p/1261322 <P><SPAN class="citation-96 citation-end-96">Learn how the Palo Alto Networks Advanced DNS Security Resolver (ADNSR) now intercepts and rewrites DNS queries for supported search engines directly at the resolution stage.</SPAN> Get instant, zero-touch SafeSearch coverage across Google, Bing, YouTube, and more in less than two minutes.</P> Fri, 07 Aug 2026 08:29:18 GMT https://live.paloaltonetworks.com/t5/general-articles/introducing-safe-search-for-the-advanced-dns-security-resolver/ta-p/1261322 nfish 2026-08-07T08:29:18Z