What is 1.1.1.1
1.1.1.1 is a public DNS resolver operated by Cloudflare that offers an alternative to your ISP or other recursive DNS servers. Instead of your browser contacting your ISP to look up domain names, 1.1.1.1 performs that lookup and returns the IP address, helping some users achieve faster name resolution and access content delivery that aligns with Cloudflare’s global network. It is not a VPN, proxy, or content filter, but it can be part of broader privacy and security practices.
This evergreen explainer covers who runs 1.1.1.1, how it works, how it handles privacy and logs, how it differs from other resolvers, and how to configure it across devices and routers.
Ownership and operator
Cloudflare DNS project
1.1.1.1 is operated by Cloudflare, an American publicly traded company (ticker: NET) that provides content delivery, DDoS mitigation, wide area network, Domain Name System, and Internet security services. Cloudflare launched the 1.1.1.1 resolver in April 2018 as part of a privacy and performance initiative, making it one of the largest public DNS services globally by anycast scale.
How 1.1.1.1 works
When you use 1.1.1.1, your device sends DNS queries to Cloudflare’s anycast network, which routes the request to the nearest data center capable of answering or recursively resolving the name. The resolver either returns a cached answer or queries authoritative nameservers for the domain. Responses are sent back to the requesting client over UDP or TCP on port 53, with optional DNS over TLS (DoT) and DNS over HTTPS (DoH) support for encrypted transport.
Key operational notes:
- It supports DNSSEC validation, which helps ensure the authenticity of DNS data.
- The resolver aims to minimize latency through Cloudflare’s global edge network.
- It does not perform active proxying, inspection, or rewriting of web traffic beyond DNS resolution.
Privacy and log policy
Short‑term log retention and anonymization
Cloudflare states that 1.1.1.1 does not store user IP addresses alongside DNS queries in long‑term logs. Instead, it scrubs identifiable information from query logs within 24 to 48 hours and applies additional anonymization techniques. This is intended to reduce data persistence while still allowing operational and security monitoring. Users who rely on very strict privacy threat models should review Cloudflare’s published privacy policy and RFC-style documentation for detailed disclosures.
Security features and safeguards
DNS over HTTPS, DNS over TLS, and malware blocking
1.1.1.1 supports DNS over HTTPS (DoH) and DNS over TLS (DoT), which encrypt DNS queries between your device and the resolver to prevent on-path snooping or tampering. Cloudflare also operates 1.1.1.1 With WARP, a secure tunnel that can proxy all Internet traffic through Cloudflare’s network when enabled. In addition, the service includes malware and phishing blocking for certain enterprise and consumer configurations, using threat intelligence feeds to return a reserved NXDOMAIN response for known malicious domains.
| Attribute | Verified Detail | Source Type |
|---|---|---|
| Operator | Cloudflare, Inc. | Company disclosure |
| Launch date | April 2018 | Cloudflare press and blog |
| Protocol support | DNS, DNSSEC, DoT, DoH, DNS64 | Cloudflare documentation |
| Log retention for DNS queries | Scrubbed within 24–48 hours; no user‑IP/query pairing retained long‑term | Cloudflare privacy policy and transparency reports |
| Malware/phishing blocking | Available in 1.1.1.1 for families and WARP; blocks known malicious domains | Cloudflare security documentation |
| Anycast presence | Global anycast across hundreds of data centers | Cloudflare network maps |
How it compares to other resolvers
Different public resolvers emphasize different trade-offs among speed, privacy, security, and policy. 1.1.1.1 emphasizes minimal logging and encryption, whereas some other services may offer broader parental controls, enterprise telemetry, or alternative blocking policies. Choosing a resolver depends on your performance requirements, privacy preferences, and whether you need additional features like threat blocking or logging for administrative purposes.
How to configure 1.1.1.1
You can set 1.1.1.1 at the device level or on your router so all devices on the network use it by default.
Manual device setup
- Windows: Control Panel > Network and Sharing Center > Change adapter settings > IPv4 > Properties > Preferred DNS: 1.1.1.1, Alternate DNS: 1.0.0.1.
- macOS: System Preferences > Network > Advanced > DNS > + 1.1.1.1 and + 1.0.0.1.
- iOS: Settings > Wi-Fi > tap i > DNS > Manual, add 1.1.1.1 and 1.0.0.1.
- Android: Settings > Network & internet > Private DNS > Private DNS provider hostname: dns.cloudflare.com (or enter 1.1.1.1 at network level depending on device).
- Linux: netplan, NetworkManager, or /etc/resolv.conf depending on distribution; typically set dns 1.1.1.1 1.0.0.1.
Router best practice
For whole‑home coverage, enter the DNS servers in your router’s WAN or LAN DNS settings and disable DHCP DNS assignment from the ISP, if applicable. Keep a backup such as your ISP DNS or another public resolver in case of resolver outages, and test name resolution after changes.
Availability and status
Uptime, incidents, and support
1.1.1.1 is available globally via anycast and is backed by Cloudflare’s infrastructure SLA. You can check current incidents and performance on Cloudflare’s status page. For advanced controls, families may use the 1.1.1.1 app for parental controls and WARP for encrypted routing; enterprise customers can integrate via Cloudflare for Teams or Cloudflare Gateway.
When to consider alternatives
If you require different privacy rules, stronger parental controls, or organization‑level policy enforcement, other resolvers or Cloudflare Gateway may be more appropriate. For most users seeking a faster, non‑intrusive resolver with limited logging, 1.1.1.1 is a dependable evergreen choice that remains well supported across operating systems and devices.