So a major webfilter vendor has a huge bug where they do not filter https connections that include an '&' in the URL. For a school district this is a very bad thing because we are not filtering any connections to google sites (e.g. images and videos are the big ones). The solution is to set up BIND to only redirect www.google.com to nosslsearch.google.com. This forces the connection to a non-https connection so the webfilter will work correctly.The bind set up is: db.override: $TTL 3600 $ORIGIN www.google.com. @ IN SOA ns3.nsd.org. root.ns3.nsd.org. ( 2012112900 ; sn = serial number 28800 ; ref = refresh = 8h 900 ; ret = update retry = 15m 604800 ; ex = expiry = 1w 3600 ; min = minimum = 1h ) IN NS ns3.nsd.org. IN A 216.239.32.20 ; override $ORIGIN with this IP ns3 IN A