Verify You're Using Cutline
After configuring your DNS, follow these steps to confirm you're using the cut path.
Automatic DNS Check
Click the button below to check if this device is using Cutline DNS:
How this check works
When you click "Check Now," your browser silently probes two hostnames:
on.thecutline.org— exists only on Cutline DNS, not in public DNSoff.thecutline.org— exists in public DNS but is on the Cutline block overlay, so a cut path must return NXDOMAIN
Green (you are on a cut path) only if: the first fetch succeeds and the second fetch fails.
Any other combination means you are not on a cut path. If both succeed, you are either using public DNS, a mixed resolver, or Cutline is not blocking the off probe (leak). If the on probe fails, you are not using Cutline DNS. If both fail, you are not on a cut path.
You are not sent to either hostname. The check is performed silently in JavaScript with fetch, and all errors are caught by this page.
Test Steps
Run the Automatic Check
Use the Automatic DNS Check button above to verify you're on the cut path. This is the easiest and most reliable verification method.
The check automatically retries for ~15 seconds if needed to account for DNS cache clearing.
Test Normal Sites Work
Visit a normal website to confirm DNS is working:
- example.com — Should load
- wikipedia.org — Should load
- github.com — Should load
If these sites don't load, your DNS configuration may be incorrect. Double-check the settings.
Use the Canary (Connection Proof, Not DNS Proof)
Visit the HTTP canary by IP address to confirm you can reach the resolver infrastructure:
Important: This canary proves you can connect to this path, NOTthat you're using these DNS servers. It is connectivity verification only.
The hostname canary on.narge.test exists but is weak in Safari (may be bypassed by search).
If the Check Stays Red
Browser DNS Cache Workaround
Safari and other browsers cache DNS aggressively. If the automatic check stays red after you've enabled Cutline DNS, the browser may still have old DNS records cached.
- macOS Safari: Fully quit Safari (⌘Q), then reopen it
- iOS Safari: Swipe up to close Safari completely, then reopen
- Chrome/Firefox: Restart the browser
The automatic check already retries for ~15 seconds, so try that first before restarting your browser.
Command-Line DNS Check (Advanced)
If you're comfortable with terminal/command prompt, you can directly query Cutline DNS:
macOS/Linux
dig @64.176.200.99 example.comShould return an address for example.com.
Windows
nslookup example.com 64.176.200.99Should return an address for example.com.
Test a Blocked Domain
Query a domain from the Narge list. It should return NXDOMAIN (no such domain).
Troubleshooting
Normal sites don't load
- Double-check the DNS server IPs:
64.176.200.99and149.28.79.49 - Restart your device or renew DHCP
- Try flushing DNS cache (see below)
- On Windows, make sure you selected "Manual" DNS, not "Automatic"
Blocked sites still load
- Check that your device isn't using another DNS source (VPN, proxy, iCloud Private Relay, corporate network)
- On iOS, verify DNS is set for the specific Wi-Fi network you're on
- The site may not be in the Narge list (the list is an approximation)
- If the automatic check above is green but sites still load, browser cache may be serving old content — try restarting the browser
Windows: IPv6 DNS Leak
Even after setting the IPv4 Cutline DNS servers, Windows may prioritize an IPv6 DNS resolver from your router, bypassing Cutline. To check:
ipconfig /allLook at the DNS Servers list. If an IPv6 address appears first (e.g., starting with2600: or fe80:), Windows is not using Cutline DNS. The Settings app "IPv6 DNS Off" toggle does not prevent this.
Fix: Disable IPv6 on your network adapter:
- GUI: Press Win+R, type
ncpa.cpl, press Enter. Right-click your connection, select Properties, and uncheckInternet Protocol Version 6 (TCP/IPv6). - PowerShell (Administrator):
Disable-NetAdapterBinding -Name 'Wi-Fi' -ComponentID ms_tcpip6
After disabling IPv6, run ipconfig /flushdns and retest with the Check Now button above.
Flush DNS Cache
macOS:
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderWindows:
ipconfig /flushdnsLinux:
sudo systemd-resolve --flush-caches