Years ago I did school IT, during the time when all websites moved to SSL-only. We used to filter websites easily with Squid and something called Dan's Guardian. When Google switched to SSL-only we had to change. We could have required everyone to install certificates, but instead we used PowerDNS with Lua to force all Google search related queries to answer with a Google-provided CNAME.

https://gist.github.com/hayesr/55b55d167f67f57fe5e56ec3ab1f8...