In short. 1.1.1.1 is Cloudflare's public DNS resolver. It comes in three address pairs: plain, one that blocks malicious domains, and one that adds adult content filtering. Setup takes minutes and it supports DoH and DoT. One quirk stands apart: for some people it does not work at all — not because of the service, but because 1.1.1.1 spent years being used as a throwaway address in network equipment.
What 1.1.1.1 is
Cloudflare DNS is a public recursive resolver running on the company's anycast network. Your query lands at the point of presence nearest to you rather than at one server in a particular country: 1.1.1.1 is announced from many places at once and routing picks the closest.
What separates it from Quad9 and AdGuard DNS is what the primary address does not do: it filters neither advertising nor malicious domains. Plain 1.1.1.1 returns the answer as it is. Filtering lives on separate addresses, and that is a deliberate choice — not deciding on your behalf what you may see.
A public resolver does not make you anonymous. It only changes who sees your DNS queries. Your ISP still sees the IP addresses you connect to, and the SNI field in the TLS handshake often reveals the hostname anyway.
Cloudflare DNS addresses: three pairs
| Pair | IPv4 | IPv6 | What it does |
|---|---|---|---|
| Primary | 1.1.1.1 1.0.0.1 | 2606:4700:4700::1111 2606:4700:4700::1001 | No filtering at all |
| Malware blocking | 1.1.1.2 1.0.0.2 | 2606:4700:4700::1112 2606:4700:4700::1002 | Blocks malicious domains |
| Family | 1.1.1.3 1.0.0.3 | 2606:4700:4700::1113 2606:4700:4700::1003 | Malware plus adult content |
The scheme is convenient because the final digit encodes the mode outright: .1 unfiltered, .2 protected, .3 family. Easier to remember than a set of unrelated subnets.
Do not mix addresses from different pairs. Combining 1.1.1.1 with 1.0.0.2 gives behaviour that depends on which resolver answered first: one malicious domain is filtered, the next one is not.
Why 1.1.1.1 does not work for some people
This is the most common and most confusing problem with it, and the root is historical rather than technical.
The address is short and memorable, and long before Cloudflare was given it to operate, network engineers used it as a placeholder for years: in test configurations, in documentation examples, as a sink for traffic that had to go somewhere. Some equipment and ISP networks still treat 1.1.1.1 specially — intercepting it, dropping it, or answering in its place.
The symptom is recognisable: 1.1.1.1 does not answer while 1.0.0.1 works fine. Or everything is fine at home and silent on an office network or public Wi-Fi. None of that is a fault in the resolver.
# Does the address answer at all
dig +short +time=3 example.com @1.1.1.1
dig +short +time=3 example.com @1.0.0.1
# Where the traffic actually goes — interception shows in the hop count
traceroute -n -m 8 1.1.1.1
# Is somebody answering in its place? Cloudflare has a diagnostic TXT record
dig +short TXT whoami.cloudflare @1.0.0.1If 1.0.0.1 works and 1.1.1.1 does not, use the second address as your primary — the order carries no meaning. If neither answers while other resolvers do, the problem sits in the network between you and Cloudflare.
Privacy: what is retained
The stated policy is that the source IP address of a query is never written to disk and operational logs are purged within a day. The company has brought in outside auditors to examine those claims — not a guarantee in itself, but more than a promise on a page.
One detail matters for comparison: on the primary address Cloudflare does not send ECS, so part of your IP address never reaches authoritative servers. A gain for privacy and a loss for CDN geolocation accuracy: content may occasionally be served from a more distant node.
How to set it up
Router
Find the WAN, Internet or DHCP section and the field for manual DNS entry. Enter 1.1.1.1 and 1.0.0.1, save, reboot. Configuring the router covers the whole network, including devices with no DNS settings of their own.
Windows, macOS, Linux
# Windows
netsh interface ip set dns name="Ethernet" static 1.1.1.1
netsh interface ip add dns name="Ethernet" 1.0.0.1 index=2
ipconfig /flushdns
# macOS
sudo networksetup -setdnsservers "Wi-Fi" 1.1.1.1 1.0.0.1
sudo dscacheutil -flushcache
# Linux with systemd-resolved
sudo resolvectl dns wlan0 1.1.1.1 1.0.0.1
sudo resolvectl flush-cachesAfter switching, flush the system and browser caches or some domains will keep answering from the old resolver. Every caching layer is covered in the guide on flushing the DNS cache.
DoH and DoT
# DoH — for browsers
https://cloudflare-dns.com/dns-query
# DoT — hostname for system resolvers and Android
one.one.one.one
# Testing DoH (RFC 8484)
curl -s -H 'accept: application/dns-message' 'https://cloudflare-dns.com/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | xxd | head -3The hostname one.one.one.one is not a joke but a working host: it goes straight into Android's Private DNS field, which insists on a name rather than an address. The mechanics of encrypted DNS are covered in the article on DNS over HTTPS.
A browser may query its own DoH resolver regardless of system settings. Verify the setup from the browser rather than from a system utility alone, or it is easy to conclude everything switched when only half of it did.
1.1.1.1 and WARP are not the same thing
The app called "1.1.1.1" does two different jobs and they are constantly confused. In resolver mode it simply directs DNS queries to 1.1.1.1 over an encrypted channel. In WARP mode it wraps all of the device's traffic in a tunnel to the nearest Cloudflare node.
The difference is practical. Changing your resolver does not change your visible IP address and does not affect how traffic is routed. WARP changes both: sites see a Cloudflare node's address rather than yours. If the goal is only to change DNS, WARP is unnecessary; if you are chasing an access problem, understand that you are enabling a full tunnel, not a name-resolution setting.
Availability and large-scale outages
Cloudflare is both a resolver and a very large CDN sitting in front of millions of sites, which makes its availability a broader question than one resolver's uptime. When something goes wrong at that scale, it affects sites as much as name resolution.
The practical conclusion is simple: do not treat an unreachable 1.1.1.1 as proof that your own machine is broken. Compare with another resolver first — if the others answer and Cloudflare does not, the cause sits outside your device.
Cloudflare, Quad9 and AdGuard compared
| Property | Cloudflare 1.1.1.1 | Quad9 9.9.9.9 | AdGuard DNS |
|---|---|---|---|
| Filtering on the primary address | None | Malicious domains | Ads and trackers |
| Separate filtered address | 1.1.1.2 and 1.1.1.3 | Not needed | Family and unfiltered |
| ECS on the primary address | No | No | No |
| Operator | Commercial company, US | Non-profit foundation, Switzerland | Commercial company, Cyprus |
| DoQ | No | No | Yes |
Pick by the job: a resolver that decides nothing on your behalf — Cloudflare; protection from malicious domains without interfering with content — Quad9; advertising gone across every device — AdGuard. A broader comparison lives in our roundup of public DNS servers.
About "the fastest DNS"
Cloudflare is frequently called the fastest resolver, and in comparative benchmarks it often does come first. But those benchmarks average the entire world, and the only location that matters to you is yours.
Speed comes from the distance to a given network's nearest point of presence and the quality of the route there. A network with more points has better odds, not a guarantee: an ISP will sometimes route you to the "nearest" point through another country. The only honest method is measurement.
# Compare response time of three resolvers from where you actually are
for R in 1.1.1.1 9.9.9.9 94.140.14.14; do
echo -n "$R: "
dig +noall +stats example.com @$R | awk '/Query time/{print $4, $5}'
doneHow to verify it works
Three things deserve checking: which resolver actually answers, whether anyone is answering in its place along the way, and whether anything you need has broken.
If dig is unavailable, the same checks work from a browser. DNS Lookup returns every record type and compares roughly twenty resolvers in one table, so a divergence between Cloudflare and the rest is immediately visible. Where you suspect interference on the path, compare through the DNS propagation check: identical answers everywhere except on your own connection point at tampering rather than a domain problem.
For site owners: if your records stop resolving at a major public resolver for any reason, part of your audience simply will not reach the site and will not tell you. Records can be placed under continuous monitoring, turning that into an alert rather than a traffic decline.
Frequently asked questions
Is Cloudflare DNS free?
Yes, the public addresses are free and require no registration. The company's paid products are its CDN, security services and a corporate filtering resolver; none of them relate to 1.1.1.1.
1.1.1.1 does not answer but other resolvers do. What is that?
Most often it is special handling of that address on your network — it spent years as a placeholder in networking equipment. Try 1.0.0.1: if it answers, make it your primary.
Does Cloudflare block malicious sites?
Not on the primary address, which returns answers as they are. Use 1.1.1.2 for malware filtering and 1.1.1.3 for malware plus adult content.
How does the address differ from the "1.1.1.1" app?
The address changes only your resolver. The app in WARP mode wraps all traffic in a tunnel and changes your visible IP address — a fundamentally different thing sharing one name.
Is it really the fastest?
In averaged benchmarks often yes, but a world average says nothing about your location. Measure three resolvers where you are; it takes a minute and is the only honest answer.
Do I need a backup resolver?
Configure both addresses of the pair. It also helps to remember a resolver from a different operator: if the whole Cloudflare network is unreachable, its second address will not save you but someone else's resolver will.
Migration checklist
- Pick a pair: .1 unfiltered, .2 with malware protection, .3 adding adult content.
- Configure both addresses of the chosen pair without mixing pairs.
- Start at the router to cover devices with no DNS settings of their own.
- Add the IPv6 addresses if IPv6 is active on your network.
- Flush the system and browser caches.
- Confirm Cloudflare is answering rather than a cached older resolver.
- If 1.1.1.1 is silent, test 1.0.0.1 before hunting for a fault on your side.
- Do not confuse changing the resolver with enabling WARP; they are different.
- Measure response times yourself instead of trusting averaged reviews.