DNS resolver IPs and hostnames
When you create a location, Gateway assigns IPv4/IPv6 addresses and DoT/DoH hostnames to that location. These are the IP addresses and hostnames you send your DNS queries to for Gateway to resolve.
To view the DNS resolver IPs for a location, navigate to Gateway > Locations and expand its location card.
How Gateway matches queries to locations
Gateway uses different ways to match a DNS query to locations depending on the type of request and network. This is how Gateway determines the location of a DNS query:
Step 1: Gateway checks whether the query was sent using DNS over HTTPS. If yes, Gateway looks up the location by its unique hostname.
Step 2: If the query was not sent with DNS over HTTPS, Gateway checks whether it was sent over IPv4. If yes, it looks up the location by the source IPv4 address.
Step 3: If the query was not sent over IPv4, it means it was sent over IPv6. Gateway will look up the location associated with the DNS query based on the unique DNS resolver IPv6 address.
When you create a location, your location will receive a unique DNS resolver IPv6 address. This IPv6 address is how Gateway will match DNS queries to locations and apply the appropriate filtering rules.
DNS resolver IP
For queries over IPv4, the default DNS resolver IP addresses are anycast IP addresses, and they are shared across every Cloudflare Zero Trust account.
If you are on the Enterprise plan, you can request a dedicated DNS resolver IPv4 address to be provisioned for a location in lieu of the default anycast addresses. Like IPv6, queries forwarded to that address will be identified using the dedicated DNS resolver IPv4 address.
Gateway uses the public source IPv4 address of your network to identify your location, apply policies and log DNS requests. When creating a location, the Zero Trust dashboard automatically identifies the source IP address.
If you are on the Enterprise plan, you have the option of manually entering one or more source IP addresses of your choice. This enables you to create Gateway locations even if you are not connecting from any of those networks' IP addresses.
DNS over TLS
Each location is assigned a unique hostname for DNS over TLS (DoT). Gateway will identify your location based on its DoT hostname.
DNS over HTTPS
Each location is assigned a unique hostname for DNS over HTTPS (DoH). Gateway will identify your location based on its DoH hostname.
Each location in Cloudflare Zero Trust has a unique DoH subdomain (previously known as unique ID). If your organization uses DNS policies, you can enter your location’s DoH subdomain as part of the WARP client settings.
In the example below, the DoH subdomain is:
|DNS over HTTPS hostname||DoH subdomain|
Send specific queries to Gateway
By default, all queries from a configured location will be sent to its DNS resolver IP address to be inspected by Gateway. You can configure Gateway to only filter queries originating from specific networks within a location:
- with the IPv4 and/or IPv6 addresses that your organization will source queries from.
- Add a condition to your DNS policies.
For example, if you want to block security threats for specific networks, you could create the following policy:
|Security Categories||In||Select all categories that apply|
|Source IP||In List||The name of the IP list containing your organization’s networks|