Why is the IPv6 address not derived from APNIC space?

The 1.1.1.1 and 1.0.0.1 addresses came from APNIC's research allocation under a joint agreement. Cloudflare had no such constraint in IPv6 and used its own 2606:4700::/32 block.

What are the IPv6 addresses for the filtered resolvers?

2606:4700:4700::1112 and ::1002 for malware blocking, 2606:4700:4700::1113 and ::1003 for the family filter.

Do I need it if I already use 1.1.1.1?

On a dual stack connection, yes. Without an IPv6 resolver configured, IPv6 lookups often fall back to whatever your router advertises, usually the ISP resolver.

Run dig @2606:4700:4700::1111 example.com on macOS or Linux, or nslookup example.com 2606:4700:4700::1111 on Windows.

2606:4700:4700::1111: Cloudflare DNS (IPv6)

2606:4700:4700::1111 is the primary IPv6 address of Cloudflare's public DNS resolver, the same service as 1.1.1.1. The secondary is 2606:4700:4700::1001. Both sit inside Cloudflare's own IPv6 allocation rather than the APNIC research space the IPv4 addresses use.

Public resolver2606:4700:4700::1111

Operated by Cloudflare, Inc. (AS13335).

Live data

Fetched now, cached at the edge

Classification: public (RFC 4291)
Reverse DNS: one.one.one.one
ASN: AS13335
AS name: Cloudflare, Inc.
Netname: Not published
Registry: ARIN — American Registry for Internet Numbers
Country: United States
Block: Not published
Registered: Not published
Abuse contact: Not published in RDAP
Blocklists: 0 of 9 zones list it

Hostname: DNS PTR via 1.1.1.1 · ASN: IPinfo Lite · AS name: IPinfo Lite · Geo: IPinfo Lite. Registry data from RDAP. Reverse DNS and blocklist checks over DNS-over-HTTPS. Run a full lookup on 2606:4700:4700::1111.

2606:4700:4700::1111 is the primary IPv6 address of Cloudflare’s public DNS resolver, the same service as 1.1.1.1. The secondary is 2606:4700:4700::1001. Both sit inside Cloudflare’s own IPv6 allocation rather than the APNIC research space the IPv4 addresses use.

Where the address comes from

Cloudflare holds 2606:4700::/32, an allocation from ARIN that also covers the anycast addresses it uses for customer sites. The resolver lives in 2606:4700:4700::/48, where the repeated 4700 makes the prefix easier to recognise in a routing table or a firewall rule.

The interface identifier encodes the IPv4 address the way Google’s does: ::1111 for 1.1.1.1, ::1001 for 1.0.0.1. The IPv4 pair had to come from APNIC because of the research agreement that made 1.1.1.1 available in the first place. IPv6 had no such history attached, so Cloudflare simply used its own space.

The full set in one /48

IPv6 address pair	IPv4 equivalent	Filtering
`::1111`, `::1001`	1.1.1.1, 1.0.0.1	None
`::1112`, `::1002`	1.1.1.2, 1.0.0.2	Malware
`::1113`, `::1003`	1.1.1.3, 1.0.0.3	Malware and adult content

All six share the prefix 2606:4700:4700:.

When you see it

In ipconfig /all and scutil --dns on dual stack machines.
In router IPv6 DNS or RDNSS fields, which are configured separately from the IPv4 DHCP DNS fields on most firmware.
In /etc/resolv.conf on servers with IPv6 connectivity, written in the collapsed :: form.
In cloud provider VPC DNS settings for IPv6-only subnets.
In firewall rules that permit outbound UDP and TCP port 53 over IPv6.

How to configure it

Windows: adapter properties, Internet Protocol Version 6, preferred 2606:4700:4700::1111, alternate 2606:4700:4700::1001.
macOS and iOS: add both under DNS in the interface details, alongside the IPv4 addresses.
Linux: add them to resolv.conf or the DNS= directive in /etc/systemd/resolved.conf.
Android 9 and later: use Private DNS with the hostname one.one.one.one, which covers IPv4 and IPv6 without typing an address.
Router: put them in the IPv6 DNS field so Router Advertisements carry them to clients through RDNSS.

Privacy and policy

The Cloudflare public resolver privacy commitments apply to every address the service runs. Cloudflare states that it does not write querying IP addresses to disk, discards operational logs within 24 hours, does not sell query data, and publishes independent examinations of those claims. The resolver validates DNSSEC and does not send EDNS Client Subnet by default.

That last point carries more weight over IPv6. An IPv6 client typically has a globally unique address with no NAT in front of it, so the address in a query identifies a single machine rather than a household. Withholding client subnet data from authoritative servers matters correspondingly more.

What it is not

The address is not assignable to your device and not a gateway. Configuring it does not give an IPv4-only connection access to IPv6 sites, because you need working IPv6 to reach the resolver in the first place. And an IPv6 resolver does not force IPv6 connections: it answers A and AAAA queries alike, and your operating system decides which to use.

Check whether you have usable IPv6 at all on /ipv6-test.

Questions people ask

Why is the IPv6 address not derived from APNIC space?: The 1.1.1.1 and 1.0.0.1 addresses came from APNIC's research allocation under a joint agreement. Cloudflare had no such constraint in IPv6 and used its own 2606:4700::/32 block.
What are the IPv6 addresses for the filtered resolvers?: 2606:4700:4700::1112 and ::1002 for malware blocking, 2606:4700:4700::1113 and ::1003 for the family filter.
Do I need it if I already use 1.1.1.1?: On a dual stack connection, yes. Without an IPv6 resolver configured, IPv6 lookups often fall back to whatever your router advertises, usually the ISP resolver.
How do I test it?: Run dig @2606:4700:4700::1111 example.com on macOS or Linux, or nslookup example.com 2606:4700:4700::1111 on Windows.

Last reviewed 2026-09-04. editorial