Run Your Own Cut Path

Anyone can run a cut path DNS resolver. Cutline is one operator, not the only one. This guide shows you how to deploy your own.

Why Run Your Own?

Control: Full control over configuration, upstream DNS, and overlay rules
Privacy: No third-party DNS queries (all resolution happens on your infrastructure)
Customization: Add your own block/allow lists on top of the Narge spec
Local deployment: Run it on your home network or organization's infrastructure
Resilience: Don't depend on any single operator

What You Need

A Linux server, VPS, or Raspberry Pi with Docker installed
Basic command-line skills
Access to the narge-spec repository

Quick Start with Docker

1. Clone the Repository

git clone https://github.com/dov-max/narge-spec.git
cd narge-spec

2. Start the Resolver

Using Docker Compose (recommended):

docker compose -f resolver/docker-compose.yml up -d

Or with a direct Docker command:

docker run -d \
  --name blocky \
  -v "$(pwd)/resolver/config.yml:/app/config.yml:ro" \
  -p 53:53/udp \
  -p 53:53/tcp \
  ghcr.io/0xerr0r/blocky

3. Test It

dig @127.0.0.1 example.com

Should return an address. Test a blocked domain to verify blocking works.

4. Configure Your Devices

Point your devices to your server's IP address as the DNS server. Use the same setup process as getting on Cutline, but with your own server's IP.

Configuration

The resolver configuration is in resolver/config.yml. Key settings:

Block Lists

The default configuration loads:

StevenBlack hosts list (temporary Narge approximation)
GitHub overlay files (overlay/block.txt, overlay/allow.txt)

Lists refresh automatically every 24 hours. Edit the overlay files to add corrections.

Upstream DNS

Default upstream is Cloudflare 1.1.1.1. Change this in config.yml:

upstream:
  default:
    - 1.1.1.1
    - 1.0.0.1

Custom Overlay Files

You can maintain your own overlay files instead of using the GitHub URLs. Mount them as local files or host them on your own server.

Production Deployment

Port 53 Permissions

Port 53 requires root or CAP_NET_BIND_SERVICE. On Linux:

docker run --cap-add=NET_BIND_SERVICE ...

Firewall

Open UDP and TCP port 53:

sudo ufw allow 53/udp
sudo ufw allow 53/tcp

HTTPS/DoH (Optional)

Blocky supports DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT). Add to config.yml:

ports:
  dns: 53
  http: 4000
  https: 443
  tls: 853

certFile: /path/to/cert.pem
keyFile: /path/to/key.pem

Monitoring

Blocky provides Prometheus metrics. Add to config.yml:

prometheus:
  enable: true
  path: /metrics

Customization Options

Add Your Own Block Lists

Beyond Narge, you can block additional categories:

blocking:
  denylists:
    narge:
      - https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts
      - https://raw.githubusercontent.com/dov-max/narge-spec/main/overlay/block.txt
    malware:
      - https://malware-blocklist.example.com/hosts
    ads:
      - https://ad-blocklist.example.com/hosts

Allowlist for Exceptions

The allowlist overrides all denylists:

blocking:
  allowlists:
    - https://raw.githubusercontent.com/dov-max/narge-spec/main/overlay/allow.txt
    - /path/to/custom-allow.txt

Resources

Resolver README — Full deployment guide
Example config.yml — Ready-to-use configuration
Blocky documentation — Complete Blocky reference
Blocky GitHub — Source code and issues

Share Your Deployment

If you run a public cut path resolver, consider sharing it! Open an issue or PR onGitHub to list it as an alternative operator.

The goal is multiple independent operators, not one central service.