Also for those curious about how this works, if you remove the /manage portion of the URL, you're hitting the actual same-redirect service (lanechange) that the Switch will hit during the connection test.
So when enabled, that domain will redirect to switchbru/browsedns, but when disabled it returns only "ok" with Nintendo headers (X-Organization: Nintendo, which is what the Switch expects a valid connection test to do)