Cloudflare Docs
Cloudflare Zero Trust
Edit this page on GitHub
Set theme to dark (⇧+D)

Test DNS filtering

This section covers how to validate your Gateway DNS configuration.

​​ Prerequisites

Before you start, make sure you are connected to a network that is associated with the DNS location where the policy is applied.

​​ Test a DNS policy

Once you have created a DNS policy to block a domain, you can use either dig or nslookup to see if the policy is working as intended.

For example, if you created a policy to block, you can do the following to see if Gateway is successfully blocking

  1. Open your terminal.

  2. Type dig (nslookup if you are using Windows) and press Enter.

  3. If the block page is disabled for the policy, you should see REFUSED in the answer section:

    $ dig
    ; <<>> DiG 9.10.6 <<>>
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 6503
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ; IN A
    ;; Query time: 46 msec
    ;; SERVER:
    ;; WHEN: Tue Mar 10 20:22:18 CDT 2020
    ;; MSG SIZE rcvd: 29

    If the block page is enabled for the policy, you should see NOERROR in the answer section and and as the answers:

    $ dig
    ; <<>> DiG 9.10.6 <<>>
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR id: 14531
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
    ; EDNS: version: 0, flags:; udp: 1452
    ; IN A
    ;; Query time: 53 msec
    ;; SERVER:
    ;; WHEN: Tue Mar 10 20:19:52 CDT 2020
    ;; MSG SIZE rcvd: 83

​​ Test a security or content category

If you are blocking a security category or a content category, you can test that the policy is working by using the test domain associated with each category.

Once you have configured your Gateway policy to block the category, the test domain will show a block page when you attempt to visit the domain in your browser, or will return REFUSED when you perform dig using the command-line interface.

​​ Test domain format

  • One-word category — For categories with one-word names (for example, Malware), the test domain uses the following format:

  • Multi-word category — For categories with multiple words in the name (for example, Parked & For Sale Domains), the test domain uses the following format:

    • Remove any spaces between the words
    • Replace & with and
    • Lowercase all letters

​​ Common test domains

CategoryTest domain
Command and Control &
Parked & For Sale
Private IP

​​ Test EDNS configuration

If you enabled EDNS client subnet for your DNS location, you can validate EDNS as follows:

  1. Obtain your DNS location’s DOH subdomain:

    1. In Zero Trust, go to Gateway > DNS Locations.
    2. Select the DNS location you are testing.
    3. Note the value of DNS over HTTPS.
  2. Open a terminal and run the following command:

    $ curl 'https://<DOH_SUBDOMAIN>' -H 'Accept: application/dns-json' | json_pp

    The output should contain your EDNS client subnet:

    "AD" : false,
    "Answer" : [
    "TTL" : 60,
    "data" : "\"\"",
    "name" : "",
    "type" : 16
    "TTL" : 60,
    "data" : "\"edns0-client-subnet\"",
    "name" : "",
    "type" : 16
    "CD" : false,
    "Question" : [
    "name" : "",
    "type" : 16
    "RA" : true,
    "RD" : true,
    "Status" : 0,
    "TC" : false
  3. To verify your EDNS client subnet, obtain your source IP address:

    $ curl

    The source IP address should fall within the /24 range specified by your EDNS client subnet.

​​ Clear DNS cache

Modern web browsers and operating systems are designed to cache DNS records for a set amount of time. When a request is made for a DNS record, the browser cache is the first location checked for the requested record. A DNS policy may not appear to work if the response is already cached.

To clear your DNS cache:

  1. Go to chrome://net-internals/#dns.
  2. Select Clear host cache.
  1. Open the admin command prompt or PowerShell.
  2. Run the following command:
ipconfig /flushdns
  1. Open Terminal.
  2. Run the following commands:
$ sudo killall -HUP mDNSResponder
$ sudo killall mDNSResponderHelper
$ sudo dscacheutil -flushcache