1.0.0.1: Cloudflare DNS secondary

1.0.0.1 is the secondary IPv4 address of Cloudflare’s public DNS resolver. It answers exactly like 1.1.1.1 but is announced from 1.0.0.0/24 instead of 1.1.1.0/24. On networks where local equipment hijacks 1.1.1.1, the secondary address often still reaches Cloudflare.

Why the secondary sometimes works better

Both prefixes came to Cloudflare through the same APNIC research agreement, and both carried years of accumulated junk traffic before the resolver launched in April 2018. The junk was not evenly distributed. 1.1.1.1 is the address that vendors and administrators reached for when they needed a dummy value, so a long tail of firewalls, wireless controllers, and consumer gateways treat it as a local address or a captive-portal target and never let the packet leave the building.

1.0.0.1 attracted less of that. If name resolution fails on one Cloudflare address but works on the other, the cause is almost always local interception rather than anything at Cloudflare.

Where the address turns up

You will find 1.0.0.1 written in the alternate DNS field of router admin pages, in the second nameserver line of /etc/resolv.conf, and in setup instructions that list the Cloudflare pair. It appears in ipconfig /all under DNS Servers and in scutil --dns on macOS.

In packet captures it is usually quiet. Stub resolvers query the first configured server and only move to the second after a timeout, so steady traffic to 1.0.0.1 on a healthy machine suggests the primary is being dropped.

How to configure it

• As the alternate: 1.1.1.1 first, 1.0.0.1 second, on any operating system’s DNS settings.
• As the primary: swap the order if your network interferes with 1.1.1.1.
• Encrypted: DNS over TLS and DNS over HTTPS both use the hostname one.one.one.one or cloudflare-dns.com, which resolve to the whole set of addresses, so you do not choose between them.
• Router: enter both in the LAN DHCP settings rather than per device.
• Command-line test: dig @1.0.0.1 example.com on macOS or Linux, nslookup example.com 1.0.0.1 on Windows.

Privacy and policy

The same Cloudflare public resolver privacy commitments cover both addresses. Cloudflare states that it does not write the querying IP address to disk, discards operational logs within 24 hours, and does not sell query data or use it for advertising. It publishes independent examinations of those claims.

Like the primary, 1.0.0.1 validates DNSSEC and does not forward EDNS Client Subnet to authoritative servers by default. It applies no blocklist. The filtered variants live on separate addresses: 1.1.1.2 for malware blocking and 1.1.1.3 for malware plus adult content.

What it is not

1.0.0.1 is not a lower-priority or degraded service, and it is not a different cache tier. It is also not part of 1.0.0.0/8 in any meaningful sense for you: that block belongs to APNIC and the rest of it is assigned to networks across Asia Pacific. Seeing 1.0.0.1 in a device’s configuration tells you someone chose Cloudflare, nothing more.

Query a record through it in /dns-lookup, or check the route to it with /ping-test.