Documentation

What is Cutline?

Cutline is a public DNS resolver service that provides a "cut path"—an internet connection that does not resolve the Narge content class. It operates two DNS resolvers at 64.176.200.99 and149.28.79.49.

Cutline is:

• One operator providing cut path DNS (not the only one)
• Open source and publicly documented
• No signup, no charge, no accounts
• Run by Dov Allison

Cutline is not a house filter, safety product, trust brand, government program, or kids-specific service.

What is Narge?

Narge (pronounced NARJ) is a technical content class. It is narrowly defined in the Narge specification.

The classification looks at purpose and content type. It does not include CSAM (already illegal), written-only text, non-photoreal illustration, medical content, sex education, news, documentary, breastfeeding, clothing sales, or story films when purpose is not arousal.

See the full Narge specification for the complete definition and what is included or excluded.

How It Works

DNS Resolution

When you configure Cutline as your DNS server:

1. Your device asks Cutline to resolve a domain name (e.g., "example.com")
2. Cutline checks if the domain is on the Narge block list
3. If blocked: returns NXDOMAIN (domain does not exist)
4. If not blocked: queries upstream DNS (Cloudflare 1.1.1.1) and returns the result

What Gets Blocked

Cutline uses the StevenBlack hosts list(MIT license) as a temporary approximation of Narge, plus overlay corrections maintained in thenarge-spec repository.

Your Traffic

Important: Only DNS queries go through Cutline. Your actual web traffic (loading pages, downloading files) goes directly from your device to the destination server. Cutline does not see or proxy your traffic.

Privacy

Cutline collects no personal data. Query names are not stored—after a query completes, the operator cannot retrieve what was asked. The only retained data is source IP for 7 days (for rate limits and public usage statistics), then deleted.

Read the full privacy policy →

Limitations

Not a Complete Filter

Cutline only addresses the Narge content class. It does not block:

• Malware or phishing sites (use additional security tools)
• Social media content (sexual or otherwise)
• Dating or hookup apps
• Non-Narge adult content (violence, gambling, etc.)

Easy to Bypass

Someone who wants to access blocked content can:

• Change their DNS settings back to default
• Use a VPN or proxy
• Use mobile data instead of Wi-Fi

Cutline makes Narge harder to reach by accident or habit, not impossible to find.

List Quality

The block list is an approximation. It uses StevenBlack's hosts list, which is:

• Community-maintained (quality varies)
• A proxy for Narge (not exact)
• Subject to false positives and false negatives

A more accurate, community-judged host registry is a future goal.

HTTPS Cannot Be Categorized

DNS blocking only works at the domain level. HTTPS content on general-purpose platforms (Twitter, Reddit, Imgur) cannot be filtered by DNS.

Troubleshooting

Sites Won't Load

• Verify DNS settings: 64.176.200.99 and 149.28.79.49
• Restart your device or renew DHCP
• Flush DNS cache (see verification guide)
• Check for VPN or proxy overriding DNS

Blocked Sites Still Load

• Fully quit and restart your browser (especially Safari)
• Ensure no VPN or proxy is active
• On iOS, verify DNS is set for the specific Wi-Fi network
• The site may not be in the block list

Slow DNS Resolution

• Try both resolvers to see if one is faster
• Check your network connection
• Report persistent issues on GitHub

Technical Details

Resolver IPs

Primary:   64.176.200.99
Secondary: 149.28.79.49

Domain

thecutline.org (registered, HTTPS/DoH not yet live)

Software Stack

• DNS Server: Blocky (Apache-2.0)
• Block List: StevenBlack hosts list (MIT) + overlay
• Upstream: Cloudflare 1.1.1.1
• Locations: US East (EWR), US West (LAX)

Supported Protocols

• DNS (UDP/TCP port 53): ✅ Live
• DNS-over-HTTPS (DoH): ❌ Not yet available
• DNS-over-TLS (DoT): ❌ Not yet available

List Refresh

Block lists automatically refresh every 24 hours from:

• StevenBlack hosts
• Overlay files (block.txt, allow.txt)

Response for Blocked Domains

Blocked domains return NXDOMAIN (DNS response code 3), meaning "no such domain exists."

Contributing

Report Issues

Found a problem? Open an issue on GitHub.

Propose Host Changes

Use the issue templatesto propose:

• A host to add to the block list
• A host to remove (false positive)
• A new host type or classification rule

Improve Documentation

Documentation is in the narge-spec repository. Pull requests welcome.

Run Your Own

The resolver configuration is open source. Deploy your own cut pathand share it with others.