google_safesearch.lua

function preresolve(dq)
  if dq.qname:equal("www.google.com") then
    dq:addAnswer(pdns.CNAME, "forcesafesearch.google.com.")
    dq.rcode = 0
    dq.followupFunction="followCNAMERecords" -- this makes PowerDNS lookup your CNAME
    return true;
  end

  return false;
end

Force Google SafeSearch with the PowerDNS Recursor

Now that Google requires SSL for all searches, this is useful to schools and districts who want to enforce some filtering. https://support.google.com/websearch/answer/186669?hl=en

The script checks if the requested domain is www.google.com then answers with forcesafesearch.google.com. CNAME chain resolution is documented here: https://doc.powerdns.com/md/recursor/scripting/#cname-chain-resolution . I believe the final return false is necessary to tell the recursor that the function does nothing. Without it, only google.com will work.

The path of this file is referenced in recursor.conf using the lua-dns-script directive.