Skip to content
Visit on GitHub
Set theme to dark (⇧+D)

The nitty gritty


Cloudflare stopped supporting the ANY query in 2015 as ANY queries are more often used to perpetuate large volumetric attacks against the DNS system than valid use. returns NOTIMPL when asked for qtype==ANY.

DNSSEC is a DNSSEC validating resolver. sends the DO (DNSSEC Ok) bit on every query to convey to the authoritative server that it wishes to receive signed answers if available. supports all signature algorithms including the newer DS-13, DS-14, and DNS-15.

EDNS client subnet is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers.

IPv6 has full IPv6 support.

Purge cache's Purge Cache tool allows you to refresh's DNS cache for domain names. To refresh the cache for a domain name, visit the Purge Cache page.

Query name minimization

Cloudflare minimizes privacy leakage by only sending minimal query name to authoritative DNS servers. For example, if a client is looking for, the only part of the query discloses to .com is that we want to know who’s responsible for and the zone internals stay hidden.

Root hints

For decreased latency, reduced privacy leakage of queries and lower load on the DNS system, upstreams to locally hosted root zone files.


Authoritative DNS providers may want to allowlist IP's uses to query upstream DNS providers. The comprehensive list of IP's to allowlist is available at