The Nitty Gritty


Authoritative DNS providers may want to whitelist IP’s uses to query upstream DNS providers. The comprehensive list of IP’s to whitelist is available at

EDNS Client Subnet is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers


It’s not 1995. has full IPv6 support.

DNSSEC is a DNSSEC validating resolver. sends the DO (DNSSEC Ok) bit on every query to convey to the authoritative server that it wishes to receive signed answers if available. supports all signature algorithms including the newer DS-13, DS-14, and DNS-15.


Cloudflare stopped supporting the ANY query in 2015 as ANY queries are more often used to perpetuate large volumetric attacks against the DNS system than valid use. returns NOTIMPL when asked for qtype==ANY.

Root Hints

For decreased latency, reduced privacy leakage of queries and lower load on the DNS system, upstreams to locally hosted root zone files.

Query Name Minimization

Cloudflare minimizes privacy leakage by only sending minimal query name to authoritative DNS servers. For example, if a client is looking for, the only part of the query discloses to .com is that we want to know who’s responsible for and the zone internals stay hidden.