1.1.1.2: Cloudflare for Families, malware blocking

1.1.1.2 is the malware-blocking resolver in Cloudflare’s 1.1.1.1 for Families range. It behaves like 1.1.1.1 for ordinary lookups, and returns 0.0.0.0 for domains Cloudflare’s threat intelligence flags as malicious. It applies no content filtering.

How the block is delivered

Most filtering resolvers signal a block in one of two ways. Some answer NXDOMAIN, as Quad9 does, so the name looks like it does not exist. Others redirect to a warning page on their own server, which lets them explain the block but also means the browser makes a connection to the operator.

Cloudflare picked a third option: 1.1.1.2 answers with 0.0.0.0 for A records and :: for AAAA. Those are unroutable, so the connection fails at once. Nothing contacts Cloudflare beyond the DNS query, and no warning page exists to be spoofed or logged. The trade-off is that a blocked domain produces a generic connection error, so users cannot tell filtering from a network fault without checking.

The 1.1.1.1 for Families set

Addresses	Blocks
1.1.1.1, 1.0.0.1	Nothing
1.1.1.2, 1.0.0.2	Malware
1.1.1.3, 1.0.0.3	Malware and adult content

Cloudflare launched the Families tier in April 2020, two years after the original resolver, and offers it free with no account.

When you see it

The address shows up in home router DNS fields, in small business firewalls where an administrator wanted threat blocking without a subscription, and in guides aimed at people setting up a network for elderly relatives. It appears in ipconfig /all and scutil --dns the same way any manually set resolver does.

A useful diagnostic pattern: if a page fails and dig @1.1.1.2 thatdomain.com returns 0.0.0.0 while dig @1.1.1.1 thatdomain.com returns a real address, the domain is on Cloudflare’s threat list.

How to configure it

1. Router: 1.1.1.2 and 1.0.0.2 in the LAN DHCP DNS fields, which covers every device on the network.
2. Windows and macOS: the same pair under the adapter’s IPv4 DNS settings.
3. Android 9 and later: Private DNS hostname security.cloudflare-dns.com.
4. DNS over HTTPS: https://security.cloudflare-dns.com/dns-query.
5. IPv6: 2606:4700:4700::1112 and 2606:4700:4700::1002.

Privacy and policy

The same Cloudflare public resolver privacy commitments cover the Families addresses. Cloudflare states that it does not write querying IP addresses to disk, discards operational logs within 24 hours, does not sell query data, and commissions independent examinations of those claims. Using 1.1.1.2 instead of 1.1.1.1 does not change what is retained.

What it is not

1.1.1.2 is not a parental control. Adult content resolves normally, and blocking it needs 1.1.1.3. It is not antivirus either: it stops a lookup for a known bad domain, and it has nothing to say about a file downloaded from a domain that has not been reported yet. And because the block returns an unroutable address rather than an error page, it is not obvious to a user that filtering happened, so someone will eventually report the site as broken.

Check a suspicious domain against public lists in /blacklist-check.