FWD in zones not getting replies from root zone

[ferferga]

I'm looking forward forcing users to use SafeSearch in Google, as I currently have with AdGuardHome. To do so, I created the following zone:

$ORIGIN google.com.
@                     0         IN  SOA           miguel-rua_dns. invalid. 9 900 300 604800 900
@                     3600      IN  ANAME         forcesafesearch
@                     0         IN  FWD           Udp "this-server" True DefaultProxy 0
www                   3600      IN  CNAME         @

My idea is:

User queries google.com -> Technitium aliases to forcesafesearch.google.com -> As zone doesn't have A entry, query is redirected to root zone -> Root zone forwards to external DNS.

However, this last step doesn't work. This is my root zone:

$ORIGIN .
.                     0         IN  SOA           miguel-rua_dns. invalid. 37 900 300 604800 900
.                     0         IN  FWD           Tls "1.0.0.1" True NoProxy 0			;Cloudflare over TLS
.                     0         IN  FWD           Tls "1.1.1.1" True NoProxy 0			;Cloudflare over TLS
.                     0         IN  FWD           Https "h3://1.1.1.1/dns-query" True NoProxy 0			;Cloudflare over DoH over QUIC
.                     0         IN  FWD           Https "h3://1.0.0.1/dns-query" True NoProxy 0			;Cloudflare over DoH over QUIC
.                     0         IN  FWD           Https "h3://[2606:4700:4700::1111]/dns-query" True NoProxy 0			;Cloudflare over DoH over QUIC (IPv6)
.                     0         IN  FWD           Https "h3://[2606:4700:4700::1001]/dns-query" True NoProxy 0			;Cloudflare over DoH over QUIC (IPv6)
.                     0         IN  FWD           Quic "149.112.112.112" True NoProxy 0			;Quad9
.                     0         IN  FWD           Quic "[2620:fe::9]" True NoProxy 0			;Quad9
.                     0         IN  FWD           Tls "[2606:4700:4700::1001]" True NoProxy 0			;Cloudflare over TLS (IPv6)
.                     0         IN  FWD           Tls "[2606:4700:4700::1111]" True NoProxy 0			;Cloudflare over TLS (IPv6)

If I query any other site (not Google), the server answers successfully, so my forwarding is set up correctly.
In settings > Proxy & Forwarders I don't have anything set up, since, as you can see from my root zone, I want to use different forwarding protocols, which is not possible to configure directly there.
The only thing that I believe might be involved is that my server listens in port 54, but using 53 doesn't seem to change a thing.

Thank you very much in advance.

[yhay81]

Your intended design is supported, but the important detail is the zone type: google.com must be a Conditional Forwarder zone, not a Primary zone containing an FWD record.

Technitium's own SafeSearch recipe is exactly:

1. create google.com as a Conditional Forwarder zone;
2. select Use This DNS Server (exported as @ ... FWD Udp "this-server" ...);
3. add @ ANAME forcesafesearch.google.com.;
4. add www CNAME google.com..

The maintained instructions are here (the post was updated in December 2025):
https://blog.technitium.com/2020/07/how-to-enforce-google-safe-search-and.html

this-server is a special forwarder token. It requests recursive resolution inside Technitium; it does not send a normal UDP query to localhost:53, so listening on port 54 is not the cause. That recursive lookup should then use your root Forwarder zone.

I would check this in the following order:

• In Zones, verify the displayed type of both google.com and .. The former must be Conditional Forwarder/Forwarder, and the latter must be a root Forwarder zone. A Primary google.com zone is authoritative and cannot fall through to the root zone for an absent name.
• Make the ANAME target explicitly absolute: forcesafesearch.google.com. (with the final dot). Your exported relative value should expand to the same name, but making it explicit removes an import/UI ambiguity.
• Flush the server cache after changing the zone.
• In DNS Client, query forcesafesearch.google.com A against This Server first. It should resolve independently (currently to Google's SafeSearch address). Then query google.com A, and finally www.google.com A.

That split is useful:

• if forcesafesearch.google.com itself returns SERVFAIL, inspect Query Logs for that nested query; the problem is the this-server → recursive/root-forwarder path;
• if it resolves but google.com fails, the issue is the google.com zone type/ANAME processing or stale cache;
• if DNS Client works but a LAN client fails, check that the client is really querying port 54 through whatever NAT/redirect is in front of it and is not using browser/OS DoH.

Your exported FWD "this-server" record otherwise matches the documented configuration. If both zones are confirmed as Forwarder zones and the first diagnostic query still fails, please post the server version plus the Query Log rows for forcesafesearch.google.com; that would narrow this to a resolver regression rather than a zone-design issue.

Disclosure: I used OpenAI Codex to inspect the current Technitium documentation and source/UI handling for this-server, then reviewed this answer against the posted zone data.

[ShreyasZare]

Thanks for the post. The conditional forwarder zone feature implementation does not allow going back or switching to another conditional forwarder zone. Thus its not picking up FWD records from your root zone.

What you can do instead is, delete the google.com zone and add the CNAME and ANAME entries that you had earlier into the root zone. This way, it FWD records in the root zone will get picked up instead of the this-server FWD record.

Try that and let me know if that worked.