Deploy DuckDuckGo Private Search in Your Organization

If you’re an IT administrator looking to set DuckDuckGo as the default search engine across your organization, we’ve put together this handy guide to help you. All the suggested methods use standard, supported MDM policy mechanisms, so no custom software or additional licensing is required.

Why Deploy DuckDuckGo?

Because we don’t track you, ever. That’s our Privacy Policy in a nutshell. DuckDuckGo is a private search engine and browser that doesn't track users, build search history profiles, or use personal data for targeted ads. For organizations, deploying DuckDuckGo as the default search engine means:

• Employee search queries are not profiled or associated with a specific user
• No behavioral targeting - ads on results pages are based on the query, not the user.
• Compliance simplification - reduced data exposure under GDPR, FERPA, and similar privacy regulations.
• No licensing cost - DuckDuckGo Search is free to deploy.

DuckDuckGo has been operating since 2008 and handles over 100 million daily searches.

Before You Begin

All guides assume:

• You have an active management environment (Microsoft Intune, Jamf, Google Admin, or Active Directory Group Policy).
• Your account has the appropriate admin privileges to create and assign policies.
• You have a test device group to validate before broad rollout.

Forced vs. recommended policies

Where the platform supports it, each guide offers a choice between a forced policy (users cannot change the search engine) and a recommended policy (DuckDuckGo is set as default, but users can override it).

Microsoft Intune

Use the Intune Settings Catalog to deploy DuckDuckGo as the default search engine on managed Windows and macOS devices. The steps are the same for Chrome and Edge, only the settings group you need to search for is different.

Chrome (Intune)

Deploys DuckDuckGo as the default search engine in Google Chrome via the Intune Settings Catalog.

Requirements

• Microsoft Intune (Endpoint Manager)
• Devices enrolled and running the Chrome browser
• Admin role required for Intune configuration: Policy and Profile Manager

Step 1 - Create a new Configuration Profile

In the Intune Admin Portal (intune.microsoft.com) go to Devices > Configuration profiles > Create > New Policy.

• Platform: Windows 10 and later (or macOS for Mac devices)
• Profile type: Settings catalog

Name the profile, e.g. DuckDuckGo - Chrome Default Search Engine.

Step 2 - Add the search provider settings

Click Add Settings and search for Google Chrome DefaultSearchProvider. Select this option, then configure the following:

1. DefaultSearchProviderEnabled: Enabled
2. DefaultSearchProviderName: DuckDuckGo
3. DefaultSearchProviderKeyword: duckduckgo.teclab.org.cn
4. DefaultSearchProviderSearchURL: https://duckduckgo.teclab.org.cn/?q={searchTerms}
5. DefaultSearchProviderSuggestURL: https://duckduckgo.teclab.org.cn/ac/?q={searchTerms}&type=list
6. DefaultSearchProviderIconURL: https://duckduckgo.teclab.org.cn/favicon.ico

Note: If you want to allow users to override this setting, use the Recommended variants of these settings in the Settings Catalog instead.

If Chrome settings don't appear in the Settings Catalog

Some tenants are limited to configuring Google Chrome settings via the older profile method. Create the profile with Profile type Templates > Administrative Templates instead - the same Google Chrome > DefaultSearchProviderSettings are available there with identical values.

Step 3 - Assign and deploy

Assign the profile to your target device or user group and test against a small pilot group. Policies typically take effect within minutes but may take up to 24 hours to reach all devices.

Step 4 - Verify

On a managed device, open Chrome and navigate to chrome://policy. Click Reload Policies and search for DefaultSearchProviderName. The value should be set to DuckDuckGo with source Platform.

Edge (Intune)

There are two approaches:

• The Settings Catalog method (recommended for most organizations)
• The ManagedSearchEngines method (if you want users to be able to switch between a defined list of search engines).

Settings Catalog (forced or recommended)

Follow the same steps as Chrome above but navigate to Microsoft Edge > DefaultSearchProvider in the Settings Catalog. Configure these values:

1. DefaultSearchProviderEnabled: Enabled
2. DefaultSearchProviderName: DuckDuckGo
3. DefaultSearchProviderKeyword: duckduckgo.teclab.org.cn
4. DefaultSearchProviderSearchURL: https://duckduckgo.teclab.org.cn/?q={searchTerms}
5. DefaultSearchProviderSuggestURL: https://duckduckgo.teclab.org.cn/ac/?q={searchTerms}&type=list
6. DefaultSearchProviderIconURL: https://duckduckgo.teclab.org.cn/favicon.ico

For a recommended (user-overridable) policy, use settings under Microsoft Edge > Default Settings (users can override) > DefaultSearchProvider.

Important - "users can override" behavior in Edge

If a user changes the search engine away from DuckDuckGo under a "users can override" policy, DuckDuckGo disappears from their list of available search engines entirely. It cannot be selected again without IT re-applying the policy. For this reason, the ManagedSearchEngines approach is recommended for Microsoft Edge when user choice is desired, as it preserves DuckDuckGo in the list regardless of what the user selects.

ManagedSearchEngines (curated list)

In the Intune Settings Catalog, navigate to ManagedSearchEngines under Microsoft Edge and paste the following JSON:

[
  {
    "is_default": true,
    "keyword": "duckduckgo.teclab.org.cn",
    "name": "DuckDuckGo",
    "search_url": "https://duckduckgo.teclab.org.cn/?q={searchTerms}",
    "suggest_url": "https://duckduckgo.teclab.org.cn/ac/?q={searchTerms}&type=list"
  },
  {
    "keyword": "bing.com",
    "name": "Bing",
    "search_url": "https://www.bing.com/search?q={searchTerms}"
  },
  {
    "keyword": "google.com",
    "name": "Google",
    "search_url": "https://www.google.com/search?q={searchTerms}"
  }
]

Verify

Navigate to edge://policy on a managed device and confirm DefaultSearchProviderName is set to DuckDuckGo.

Google Workspace

Use the Google Admin console to deploy DuckDuckGo as the default search engine on managed Chrome browsers and Chromebooks.

Chrome / ChromeOS (Google)

Requirements

• Google Workspace (Business, Education, or Frontline)
• Super Admin or Chrome Management Admin role

Step 1 - Navigate to Chrome browser settings

In the Google Admin console (admin.google.com) go to Devices > Chrome > Settings > User & Browser. Select the organizational unit (OU) you want to target.

Step 2 - Configure the Omnibox search provider

Search for OmniboxSearchProvider (this is the label used in the Google Admin console, not DefaultSearchProvider, which is the equivalent policy name in Intune and Group Policy contexts).

Scroll to the bottom of the Omnibox Settings page, and under Configuration, select Lock the Omnibox Search Provider Settings to the values below from the dropdown menu, and then configure the following settings:

1. OmniboxSearchProviderName: DuckDuckGo
2. OmniboxSearchProviderKeyword: duckduckgo.teclab.org.cn
3. OmniboxSearchProviderSearchURL: https://duckduckgo.teclab.org.cn/?q={searchTerms}
4. OmniboxSearchProviderIconURL: https://duckduckgo.teclab.org.cn/favicon.ico

Click Save.

Step 3 - Alternative: JSON configuration

Navigate to Chrome Browser > Custom Configurations and paste:

[
  {
    "DefaultSearchProviderEnabled": true,
    "DefaultSearchProviderName": "DuckDuckGo",
    "DefaultSearchProviderKeyword": "duckduckgo.teclab.org.cn",
    "DefaultSearchProviderSearchURL": "https://duckduckgo.teclab.org.cn/?q={searchTerms}",
    "DefaultSearchProviderSuggestURL": "https://duckduckgo.teclab.org.cn/ac/?q={searchTerms}&type=list",
    "DefaultSearchProviderIconURL": "https://duckduckgo.teclab.org.cn/favicon.ico"
  }
]

Note for education admins

This policy only changes the default search engine in the Chrome address bar - it does not affect Google Classroom, Drive, Docs, or other Google services. The DefaultSearchProviderEnabled policy is fully supported in Google Workspace for Education.

Step 4 - Verify

On a managed device, navigate to chrome://policy and confirm DefaultSearchProviderName is set to DuckDuckGo.

Jamf

Use Jamf Pro to deploy DuckDuckGo as the default search engine on managed Mac devices. Safari and Chrome are covered separately below.

Safari (Jamf)

Important

Safari does not expose officially documented MDM policy keys for setting the default search engine. The PLIST keys below are community-sourced and may not work reliably across all macOS versions. Apple does not guarantee their behavior. For a fully enforced and reliable deployment, use Chrome or Firefox instead, as both have first-class MDM search policy support on macOS.

Step 1 - Create the PLIST payload

Create a file named com.apple.Safari.plist with the following content:

<? xml version = "1.0" encoding = "UTF-8" ?> 
< !DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd" >
  <plist version="1.0">
    <dict>
      <key>DefaultBrowserSearchProviderIdentifier</key>
      <string>com.duckduckgo</string>
      <key>SearchProviderIdentifier</key>
      <string>com.duckduckgo</string>
      <key>SearchProviderIdentifierMigratedToSystemPreference</key>
      <false />
    </dict>
  </plist>

Step 2 - Add the file to Jamf as a Configuration Profile

In Jamf Pro go to Computers > Configuration Profiles > New.

Set the scope to your target Smart Group or Device Group.

Step 3 - Verify

After the profile is pushed, open Safari on a managed device. Go to Safari > Settings > Search and confirm the Search Engine is set to DuckDuckGo.

Chrome (Jamf)

Chrome on macOS supports the same policy keys as on Windows, deployed as a Jamf Application & Custom Settings payload with preference domain com.google.Chrome.

Step 1 - Create the PLIST payload

Create a file named com.google.Chrome.plist with the following content:

<? xml version = "1.0" encoding = "UTF-8" ?> 
< !DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd" >
  <plist version="1.0">
    <dict>
      <key>DefaultSearchProviderEnabled</key>
      <true />
      <key>DefaultSearchProviderName</key>
      <string>DuckDuckGo</string>
      <key>DefaultSearchProviderKeyword</key>
      <string>duckduckgo.teclab.org.cn</string>
      <key>DefaultSearchProviderSearchURL</key>
      <string>https://duckduckgo.teclab.org.cn/?q={searchTerms}</string>
      <key>DefaultSearchProviderSuggestURL</key>
      <string>https://duckduckgo.teclab.org.cn/ac/?q={searchTerms}&amp;type=list</string>
      <key>DefaultSearchProviderIconURL</key>
      <string>https://duckduckgo.teclab.org.cn/favicon.ico</string>
    </dict>
  </plist>

Step 2 - Add the file to Jamf as a Configuration Profile

In Jamf Pro go to Computers > Configuration Profiles > New.

1. Under Payload Options, select Application & Custom Settings
2. Choose Upload > Add
3. Set the Preference Domain to com.google.Chrome
4. Upload the PLIST file created above

Set the scope to your target Smart Group or device group.

Step 3 - Verify

On a managed device, navigate to chrome://policy and confirm DefaultSearchProviderName is set to DuckDuckGo.

Windows Group Policy

For Windows environments not using Intune, firstownload and install the Chrome Enterprise ADMX or Edge ADMX templates in your Group Policy Central Store.

Chrome (Windows)

In Group Policy Management Editor, navigate to User Configuration > Administrative Templates > Google Chrome > DefaultSearchProvider:

1. DefaultSearchProviderEnabled: Enabled
2. DefaultSearchProviderName: DuckDuckGo
3. DefaultSearchProviderKeyword: duckduckgo.teclab.org.cn
4. DefaultSearchProviderSearchURL: https://duckduckgo.teclab.org.cn/?q={searchTerms}
5. DefaultSearchProviderSuggestURL: https://duckduckgo.teclab.org.cn/ac/?q={searchTerms}&type=list

Edge (Windows)

Navigate to User Configuration > Administrative Templates > Microsoft Edge > Default Search Provider.

Configure the same values as for Chrome above. If you want to allow users to override the policy, use the path Microsoft Edge > Default Settings (users can override) > DefaultSearchProvider - but note that the same caveat as Intune Edge applies: a user who switches away loses DuckDuckGo from their engine list. The ManagedSearchEngines policy (also available via **Group Policy **under Microsoft Edge > ManagedSearchEngines, using the same JSON as the Intune guide) is the better option when user choice is desired.

Verify

Run gpresult /R on a managed device to confirm policies are applied, then check chrome://policy or edge://policy.

Firefox

There are two deployment methods for Firefox depending on your environment:

1. For domain-joined Windows machines, use the ADMX Group Policy method.
2. For standalone or non-domain environments (including macOS and Linux), use the policies.json file method.

ADMX Group Policy (for Domain-joined Windows)

This method requires Firefox ESR (Enterprise) and the Firefox ADMX templates installed in your Group Policy Central Store.

Step 1 - Navigate to the Firefox search policy

In Group Policy Management Editor, navigate to Administrative Templates > Firefox Search.

Step 2 - Configure the default search engine

Set DefaultSearchEngine to Enabled and enter DuckDuckGo as the value.

Note: DuckDuckGo is built into Firefox, so there is no need to define a custom search engine, setting the name is sufficient.

Step 3 - Link and apply the GPO

Ensure the GPO is linked to your target OU. To apply immediately without waiting for a reboot, run gpupdate /force on target devices.

Step 4 - Verify

Open Firefox and navigate to about:policies. Confirm SearchEngines > Default is set to DuckDuckGo.

policies.json (for standalone/non-domain)

Use this method for macOS, Linux, or Windows environments where Firefox is not managed via Group Policy.

Step 1 - Create the policy file

Create the file at the appropriate path for your OS:

• Windows: C:\Program Files\Mozilla Firefox\distribution\policies.json
• macOS: /Applications/Firefox.app/Contents/Resources/distribution/policies.json
• Linux: /usr/lib/firefox/distribution/policies.json

{
  "policies": {
    "SearchEngines": {
      "Default": "DuckDuckGo",
        "PreventInstalls": false,
          "Remove": []
    }
  }
}

Note: DuckDuckGo is built into Firefox, so specifying Default > DuckDuckGo is sufficient and no additional URL configuration is required.

Step 2 - Deploy via MDM

• For Intune: deploy the file as a Win32 app or script.
• For Jamf: deploy via a package or script policy.
• For Google Admin: deploy via a managed script.

Step 3 - Verify

Open Firefox on a managed device. Navigate to About > Policies and confirm SearchEngines > Default is set to DuckDuckGo.

Verify your deployment

Regardless of which method you used, you can verify the policy is active from any managed device:

• Chrome: Visit chrome://policy - DefaultSearchProviderName should be DuckDuckGo.
• Edge: Visit edge://policy - DefaultSearchProviderName should be DuckDuckGo.
• Firefox: Visit about:policies - SearchEngines > Default should be DuckDuckGo.
• Safari: Open Safari > Settings > Search - SearchEngine should be DuckDuckGo.

Quick functional test

Type a search term (not a URL) in the browser address bar and confirm results appear on duckduckgo.teclab.org.cn.

Reference: DuckDuckGo policy values

For convenience, all DuckDuckGo-specific values referenced in this guide:

• Search name: DuckDuckGo
• Keyword/domain: duckduckgo.teclab.org.cn
• Search URL: https://duckduckgo.teclab.org.cn/?q={searchTerms}
• Suggest URL: https://duckduckgo.teclab.org.cn/ac/?q={searchTerms}&type=list
• Icon URL: https://duckduckgo.teclab.org.cn/favicon.ico
• New tab URL (optional - for new-tab-page policies, not used in this guide): https://duckduckgo.teclab.org.cn/chrome_newtab

Enforcing safe.duckduckgo.teclab.org.cn or noai.duckduckgo.teclab.org.cn

Organizations that have deployed DuckDuckGo as their default search engine may want to enforce a specific variant across all devices. For example, to filter explicit content in schools or public-facing environments, or to disable AI-generated answers and images for organizations that have policy or compliance reasons to avoid generative AI in search results.

Using Proxy or Firewall

Configure your internal DNS resolver to return safe.duckduckgo.teclab.org.cn or noai.duckduckgo.teclab.org.cn in response to queries for duckduckgo.teclab.org.cn.

This covers all devices on the network regardless of MDM enrollment or browser choice, making it suitable for BYOD environments and fleets where browser policy deployment is impractical. It does not protect devices when they are off network.

Proxy and firewall platforms that perform DNS-level filtering (such as Cisco Umbrella) can use the same approach. HTTP/S proxy rewriting requires SSL inspection and is not covered here.

Verify

From a device on the network, run nslookup duckduckgo.teclab.org.cn and confirm it resolves to the expected address. Then perform a search and confirm the results page URL reflects the intended subdomain.

Using Policy Values

Enforcing safe.duckduckgo.teclab.org.cn or noai.duckduckgo.teclab.org.cn via browser policy

Organizations that manage devices via MDM can enforce a specific DuckDuckGo experience by deploying the standard DefaultSearchEngine policy with a subdomain URL in place of duckduckgo.teclab.org.cn. This approach applies per-device and works off-network, making it complementary to DNS rewriting for managed fleets.

Follow the deployment steps for your platform, substituting the standard policy values with those below.

For safe.duckduckgo.teclab.org.cn (Safe Search - filters explicit content):

For noai.duckduckgo.teclab.org.cn (No AI — disables AI-generated answers and images):

Note: the SuggestURL remains on duckduckgo.teclab.org.cn in both cases. Address bar autocomplete is not affected by Safe Search or AI settings.

Verify

On a managed device, perform a search and confirm the results page URL begins with https://safe.duckduckgo.teclab.org.cn/ or https://noai.duckduckgo.teclab.org.cn/ respectively.

Get in Touch

If you run into issues during deployment, find a mistake in this guide, have questions about deploying DuckDuckGo in your organization, or just want to let us know that you're using DuckDuckGo (we'd love to hear from you), contact us at organizations@duckduckgo.teclab.org.cn.