YouTube Restricted Mode via DNS

[BioBen]

I'm a simpleton who's trying to enforce safe mode for youtube via DNS from our 2012R2 server as discussed here: https://support.google.com/a/answer/6214622?hl=en

 

I thought I have it setup per the instructions, but it is blocking access to accounts.youtube.com which then blocks access to many videos.

 

Currently, the DNS forward lookup Zone for youtube looks like this: I made similar changes to youtube.googleapis.com, Youtubei.googleapis.com and youtube-nocookie

 

 

 

Help is appreciated!

[Guest Guest]

I had issues when trying to implement this. Turns out you can’t enforce this using Windows Server DNS the away they documented it. I’d guess the reason YouTube is currently ‘blocked’ is because you’ve created a zone for YouTube. com and therefore when your forwarding to restricted.youtube.com there’s no entries for this. I think I resolved this by creating a zone for each sub-domain and then creating an A record instead of a CNAME due to limitations of Windows Server DNS

[Arthur]

Currently, the DNS forward lookup Zone for youtube looks like this

You may find these instructions more helpful...

 

https://docs.google.com/document/d/1x83givfFyDPpcdwosgdLZHLIafJ0djAxDNR5lptpU2Y

 

Like @kieran1990 I also used the forward lookup zones for each sub-domain + A record method.

[BioBen]

Thanks for these instructions. I wiped out all the other things and added the A Records as needed. Each of the five zones looks like this.

 

 

And I can login and browse youtube with no issues (forced restricted, but videos play, etc), but every time I've tried to navigate to video from any of the links I've tried from a curriculum, I get the error, "This video is Restricted. Try signing in from a Google Apps Account." But I am signed into an account - this would be expected behavior if the video had bad content.

 

An example link is debit cards vs credit cards. No idea why this video would be blocked -https://www.youtube.com/watch?v=oJtecS-DVkc This video is nearly identical, but not blocked.

[species3618]

We initially had this problem with restricted mode, it blocks all sorts of videos that teachers use on a regular basis, even ones we would consider fine for students to watch, we had to then use the moderate restricted mode. It still causes issues however it's not as bad as fully restricted. More info here:

 

https://support.google.com/a/answer/6214622?hl=en

 

Regarding "his video is Restricted. Try signing in from a Google Apps Account" This only refers to unblocking videos if you're managing YouTube access using Google Apps I believe? not a normal gmail account.

[Duke5A]

Thanks for these instructions. I wiped out all the other things and added the A Records as needed. Each of the five zones looks like this.

 

[ATTACH=CONFIG]49156[/ATTACH]

 

And I can login and browse youtube with no issues (forced restricted, but videos play, etc), but every time I've tried to navigate to video from any of the links I've tried from a curriculum, I get the error, "This video is Restricted. Try signing in from a Google Apps Account." But I am signed into an account - this would be expected behavior if the video had bad content.

 

An example link is debit cards vs credit cards. No idea why this video would be blocked -https://www.youtube.com/watch?v=oJtecS-DVkc This video is nearly identical, but not blocked.

 

Sounds like you have DNS setup right. Are you using Google Apps for Education (or G-Suite, whatever they're calling it now)? If you are, the way it's supposed to work is all users have access to restricted mode; which is a specially curtailed white-list of kid friendly stuff. There is a lot of things that are friendly though that aren't in this list. Where Google Apps comes in is you can then give other accounts unrestricted access and the ability to add videos to that white-list for your domain. This access is given to your staff by making their accounts members is the 'classroom teachers' group (side note, this group also grants access to use Google Classroom). When a teacher browses videos not in your domain's white-list they'll be prompted right under the video as it plays to add it.

 

1. Turn on 'Special approvers' in the conent settings for Youtube.
   
2. Add teachers to the 'Classroom Teachers' group
   
3. Let teachers know of there new found power and take one more thing off of your plate
   

 

 

Of course, if you don't have a Google Apps domain, then disregard this post in its entirety.

[Arthur]

An example link is debit cards vs credit cards.

If you have set it up properly (including assigning permissions to users in G Suite as per the instructions I linked) you should see a blue bar underneath the video?

 

[DJ-1701]

Strange, read the documentation, followed the instruction for Windows DNS... did not work. Anything change?

[DJ-1701]

Just bumping this in case no one who knows was awake at 23:25 GMT.

 

Interestingly when putting A records in they pinged the restrict.youtube.com address, but the browsers did not use restricted when visiting YouTube.

[Arthur]

Strange, read the documentation, followed the instruction for Windows DNS... did not work. Anything change?

It's still working fine for me.

 

www.youtube.com/check_content_restrictions

 

[DJ-1701]

Bah, doesn't appear to be for me.

 

 

 

Also, do you know of a known restricted video I could attempt please? Talking to our ISP they are saying that Restricted Mode is the same as YouTube SafeSearch... which is on on their filtering... but as I get these results I want to test.

[Arthur]

Talking to our ISP they are saying that Restricted Mode is the same as YouTube SafeSearch... which is on on their filtering... but as I get these results I want to test.

When using the DNS method I found I had to disable the YouTube restrictions on our Sophos XG web filter since it was taking precedence.

 

[DJ-1701]

When using the DNS method I found I had to disable the YouTube restrictions on our Sophos XG web filter since it was taking precedence.

 

 

Well that screenshot certainly seems to suggest that it's a different option for one, and from what you are saying it sounds like settings elsewhere can conflict... so certainly worth checking with our ISP if they can put me thought to someone who knows more about this. Cheers.

[cooper549]

Just wanted to add and bump this thread as I am currently going through this.

 

The DNAME method didn't work, although it does go through to YouTube and load, it then tells me I'm offline and wont load any videos. the check content restrictions page refuses to load at all.

 

We also have an XG firewall and both safe search and YouTube restricted modes were turned off (We completely blocked YouTube for pupils previously, and it was only teachers using it to embed videos in to PP)

 

When also pinging the domain restrict.youtube.com, I have had it return numerous different IP addresses and I don't think I have seen the one mentioned in the document, so I'm wondering if anything has changed slightly also as This doesn't appear to be as simple as most people make out for me.

 

I also want to add that when performing the check on our DC's, it appears to work all checks return the strict result as expected, just any other computer on the network doesn't.

Edited August 24, 2021 by cooper549

[Duke5A]

Just bumping this in case no one who knows was awake at 23:25 GMT.

 

Interestingly when putting A records in they pinged the restrict.youtube.com address, but the browsers did not use restricted when visiting YouTube.

 

I'm a bit late to this party, but are you using a proxy in the browser settings? If so, the proxy needs to be pointing to the DNS where you have the setup done. HTTP browsing uses the proxy server DNS.