Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The resolver change is specific to this client’s Zero Trust proxy mode. It does not establish remote DNS for every SOCKS5 tool or application.
- Diagnostics combines connection health, tunnel and device metrics, network details and DEX tests. Its captive portal test briefly reconnects Wi-Fi.
- The release changes low-MTU handling, but the Windows large-hosts-file issue remains partly mitigated and the virtual-network list has a known display issue.
- The macOS release note says a minimum of 15.0, while the current beta-download table explicitly excludes 15.0.x. Do not promise compatibility or recommend installation until that conflict is resolved.
Where proxy-mode hostnames are now resolved
DNS translates a domain name into a network address. Both announcements say that in Zero Trust proxy mode, the client now sends hostnames from HTTP/HTTPS and SOCKS5 requests to Cloudflare for resolution instead of resolving them on the device. The scope is hostnames carried in those requests.
Include resolver location in your evaluation record. As a hypothetical example, if the same domain produces different resolution results before and after an update, check the client version, operating mode and resolution path together. Whether a page opens does not identify the cause. The announcement does not establish that every application uses the proxy or change other clients’ DNS behavior.
What evidence Diagnostics provides
The new Diagnostics page brings together connection status and health, live tunnel and device metrics, network details and DEX test results. DEX means Digital Experience Monitoring. These tests provide evidence about particular paths rather than a guarantee that every business application works. A speed test can compare performance inside and outside the tunnel while the client is connected.
Troubleshooting tools can collect a full warp-diag bundle or test a captive portal, the web sign-in page required by some networks. The latter briefly reconnects Wi-Fi and saves results to the Desktop, so schedule it when an interruption is acceptable. Completing a test or generating a file does not replace retesting the destination request that failed.
Reading low-MTU warnings and IPv4 fallback
MTU describes the packet size a network path can carry. This beta applies tunnel MTUs of 1147–1199 bytes measured by Path MTU Discovery. Previously, ignoring that range and retaining a larger value could drop larger packets on networks such as mobile hotspots even while the client appeared connected. A banner now flags degraded or critically low tunnel MTU and clears on recovery or disconnection.
If the measured IPv6 path MTU is below 1280 bytes, the client reconnects over IPv4 and continues preferring IPv4 until the network changes. These are behaviors under specific measured conditions, not instructions to disable IPv6 everywhere or set one manual MTU. Tunnel-MTU values also do not replace the download page’s network-interface requirements. Compare actual measurements with the failed request.
Known issues still need separate checks
The Windows notes retain a DNS-client regression involving large hosts files that can cause connectivity-check failures. The client includes a mitigation, but reduced DNS performance and failed checks may remain. A completed update therefore does not establish a complete fix.
Both platforms list a virtual-network display issue. After an administrator removes a network from a device profile or changes its default, the UI may retain the old list until the client restarts. Cloudflare says actual connections still follow the profile, selecting a removed network is rejected, and warp-cli vnet shows the current list. A fix before the next GA release is a plan, not a fix already shipped in this beta.
Check the beta track and OS support first
The official beta-download page describes an unstable testing track ahead of stable releases and advises against production use. The November 10 version 2663.1 cards cover Windows and macOS; they do not establish the same release for Linux or mobile platforms. A higher version number does not choose the approved track for every device. The Windows table lists Windows 10 LTSC, Windows 11 and Windows 365 Cloud PC running Windows 11, not every Windows 10 edition.
The macOS sources conflict. This release note says a minimum of macOS 15.0 and no support for macOS 14. The current beta-download table instead lists Sequoia 15.1+, Tahoe 26.0+ and Golden Gate 27.0+, explicitly excluding 15.0.x. Do not treat the first statement as a support guarantee for 15.0.x. Follow your organization’s process to confirm with Cloudflare before deciding on compatibility testing, and check the current table for other architecture and resource requirements.
Evaluate one specific failed request
As a checklist, record the version actually running, Windows or macOS version, Zero Trust mode, failed destination and timestamp. Have an authorized administrator arrange the evaluation. Read Diagnostics after connecting, collect the relevant measurements and retry the same authorized destination request. If only a virtual-network label is stale, distinguish its display from the actual connection and current list.
This sequence follows public documentation. No client was installed, no speed or DNS test was run, and no account, plan, fee or regional eligibility was verified for this article. The beta does not replace organization permissions or destination-platform rules. Keep release-note claims, individual test results and actual business recovery separate.
Sources
Frequently Asked Questions
Why might Windows uninstall require an administrator-generated code?
The Windows notes add protection against modification or uninstallation when enabled. Uninstallation then requires an administrator-generated code or is blocked; users, including administrators, cannot stop the service. Accepted and rejected attempts to authorize uninstall with a code or token are reported to Cloudflare. Ask the organization administrator to confirm policy. This Windows feature does not establish equivalent macOS protection.
Does automatic Global Acceleration endpoint selection apply to everyone?
The announcement requires the organization to have Global Acceleration enabled. Devices use its endpoints inside the acceleration region and standard anycast endpoints outside it, reconnecting when a network change crosses that boundary. Only users allowed to override the selection can choose endpoints in Settings. The notes provide no complete region, plan or organization-eligibility list; confirm those separately.