1.1.1.1: Cloudflare Public DNS

1.1.1.1 is Cloudflare’s free public recursive DNS resolver, announced on 1 April 2018 and run jointly with APNIC’s research arm, which holds the address space. Cloudflare anycasts it from data centres in hundreds of cities and states that it does not write client IP addresses to disk.

The APNIC arrangement

APNIC, the regional internet registry for Asia Pacific, holds 1.1.1.0/24 and 1.0.0.0/24 as research allocations. Both prefixes had a problem: they attracted enormous volumes of stray traffic, because network operators and vendors had used those addresses as internal placeholders for years. APNIC wanted to study that garbage traffic, Cloudflare wanted a memorable resolver address, and the two signed a five-year research agreement that put a real service on top of the noise.

The announcement is dated 1 April 2018, which was a joke about the address, not about the service.

When you see it

• In router firmware, where 1.1.1.1 now appears as a preset alongside Google’s addresses.
• In resolvectl status on Linux or the DNS list in macOS network details.
• In older enterprise gear as a captive-portal or default-route placeholder, which is why some corporate networks still swallow traffic to it.
• On mobile, as the address the Cloudflare 1.1.1.1 app configures through a local VPN profile.
• In traceroute output that stops early, because anycast means the address is usually one or two hops from your ISP’s edge.

How to configure it

1. Windows: adapter properties, IPv4, use 1.1.1.1 and 1.0.0.1; for IPv6 use 2606:4700:4700::1111 and 2606:4700:4700::1001.
2. macOS and iOS: add the same pair under DNS settings, or install the 1.1.1.1 app which sets a system-wide encrypted profile.
3. Android 9 and later: Private DNS, Private DNS provider hostname, one.one.one.one. That gives DNS over TLS rather than plain port 53.
4. Firefox: DNS over HTTPS is available in settings with Cloudflare as one of the listed providers.
5. Router: set the pair in the LAN DHCP DNS fields.

Privacy and policy

Cloudflare’s 1.1.1.1 privacy commitments say it does not sell or share query data, does not use it to target advertising, does not write the querying IP address to disk, and discards operational logs within 24 hours. Cloudflare commissions independent examinations of those statements and publishes the reports.

The resolver does not send EDNS Client Subnet to authoritative servers by default. That withholds a rough network location from every domain you visit, at the cost of slightly less precise CDN routing for services that rely on that hint. Google Public DNS takes the opposite default, which is the clearest technical difference between the two.

What 1.1.1.1 is not

It is not your router, and it is not an address you can be assigned. It is not a filter either, so a phishing domain resolves normally through it. Changing your resolver does not change the public IP that websites record for you, and it does not encrypt your browsing; only the DNS lookups move, and only if you use DNS over TLS or HTTPS.

Compare the answers 1.1.1.1 and 8.8.8.8 return for the same name in /dns-lookup, or confirm which resolver your device actually uses with /dns-leak-test.