Cloudflare DNS

What Is Cloudflare DNS?

You can do everything “right” online and still leak a lot about yourself through DNS. Every time you type a domain, your network needs to ask a DNS resolver where to find it — and on many networks that request is still visible to the ISP, the Wi‑Fi operator, or anyone sitting on the path.

Cloudflare’s answer is 1.1.1.1: a public DNS resolver you can use on any device, plus a consumer app that can encrypt DNS (DNS-only mode) or encrypt all device traffic to Cloudflare using WARP. The core value is simple: fewer parties get an easy, passive view of where your device is trying to go, and you get Cloudflare’s global anycast network handling DNS resolution. Cloudflare positions the resolver as privacy-focused and the app as a way to improve connection security (and sometimes performance) without trying to be a “full anonymity VPN.”

Who it’s for: people who want encrypted DNS with minimal setup, and people who want a VPN-like tunnel mainly for protection on untrusted networks (airport Wi‑Fi, hotels, coffee shops), not for pretending to be in another country. Cloudflare is unusually explicit that WARP is not designed for anonymity and isn’t meant to stop the sites you visit from identifying you.

Cloudflare DNS Features and Performance

At the DNS level, 1.1.1.1 is a public recursive resolver designed around privacy commitments. Cloudflare documents that it retains only limited transaction and debug log data for operation and research, and that those “Public Resolver Logs” are deleted within 25 hours. Cloudflare also states that it does not share 1.1.1.1 resolver logs with third parties except for anonymous logs shared with APNIC as part of a research cooperative agreement.

Where “private browsing” enters the picture is the 1.1.1.1 app and WARP modes. Cloudflare’s own docs describe a DNS-only mode where only DNS queries go through Cloudflare’s resolver, and a WARP mode where device traffic is tunneled to Cloudflare. Importantly, Cloudflare cautions that WARP doesn’t provide anonymity and isn’t designed to prevent destination servers from identifying you. If your goal is location spoofing or streaming geo-unblocking, that warning matters.

Protocols (verified)

From your verified database specs: Cloudflare DNS (via the 1.1.1.1/WARP client) uses WireGuard and MASQUE.

Cloudflare’s current WARP client documentation states that the WARP application uses MASQUE to encrypt and send traffic from your device to Cloudflare’s network. Cloudflare also documents that WARP has multiple modes (including DNS-only) and that WARP+ Unlimited is a paid monthly subscription available through the mobile app stores.

Historically, Cloudflare has also described the WARP app encrypting traffic from your device to Cloudflare’s edge using BoringTun (Cloudflare’s WireGuard implementation), which is consistent with WireGuard being part of the stack.

Speed and “performance” (what you should actually expect)

Cloudflare’s public positioning is that 1.1.1.1 can be fast because it’s integrated into Cloudflare’s global network, and that WARP is built to improve connection quality rather than slow it down like some VPNs can. But speed outcomes vary by network, location, and routing.

What is concrete: Cloudflare differentiates between WARP and WARP+ Unlimited. In Cloudflare’s own materials, WARP+ is framed around improved routing over Cloudflare’s network (Cloudflare refers to its “virtual private backbone” and Argo in its WARP+ announcement). That is not the same promise as “you’ll always be faster,” but it’s a clear statement that the paid tier is about better paths and less congestion.

Independent impressions line up with the idea that it can be a mild improvement for normal browsing, but not a miracle and not a privacy-maximizing VPN. For example, WIRED’s review described perceiving slight speed improvement in general use while connected, while emphasizing it’s not a real privacy-oriented VPN.

Filtering options: “1.1.1.1 for Families”

Cloudflare also runs resolver variants branded as 1.1.1.1 for Families. Cloudflare documents two main filtering levels: one that blocks domains associated with malware/phishing, and one that blocks adult content in addition to malware/phishing. Cloudflare also documents the IP addresses used for these variants (e.g., 1.1.1.2 for malware filtering and 1.1.1.3 for malware + adult content).

This is useful, but it’s not “private browsing” in the Tor sense. It’s DNS-based filtering: it can stop lookups to certain domains, but it can’t inspect everything happening inside an allowed domain, and it can’t guarantee you won’t see unwanted content hosted on allowed platforms.

Cloudflare also has a documented example of a filtering mistake: in 2019 it described an incident where 1.1.1.3 mistakenly blocked LGBTQIA+ sites, and Cloudflare posted a postmortem with timeline details. That’s not a reason to avoid the tool, but it’s a real trade-off of any category-based DNS filtering system: mistakes happen.

Pricing and Plans

There are two distinct “products” people lump together:

• 1.1.1.1 public DNS resolver (use it by setting your system/router DNS): free.
• 1.1.1.1 app with WARP: includes a free WARP option, with an optional paid upgrade.

Cloudflare states that 1.1.1.1 with WARP is free, and that WARP+ is a paid feature you can enable. Cloudflare also states that WARP+ Unlimited is accessed via a paid monthly subscription, and that purchases are handled via Apple App Store / Google Play (at least per Cloudflare support documentation). Cloudflare also notes pricing can vary by region.

Exact pricing is intentionally not fixed in Cloudflare’s public statements (the company explicitly frames it as regionally adjusted). In Cloudflare’s own words, the fee varies by region and is designed to approximate the cost of a Big Mac in that region.

Refunds: Cloudflare’s own documentation in the sources above does not spell out a refund window for WARP+ Unlimited. Because the subscription is purchased through Apple/Google, refund handling is generally governed by the relevant app store policies, not Cloudflare directly. (If you need a hard “refund window” statement, you’ll want to cite Apple/Google policy pages and keep it jurisdiction-specific.)

Privacy and Security Assessment

Jurisdiction and trust model

Cloudflare is a US-based company (headquartered in San Francisco, per general references), which means US jurisdiction considerations apply. That doesn’t automatically make it “bad,” but it does mean you’re ultimately trusting a large US infrastructure provider.

More important than the country is the architecture and policy: Cloudflare’s model is not “hide you from everyone.” It’s “encrypt what would otherwise be exposed on local networks/ISPs and handle it inside Cloudflare’s network.” If your threat model includes Cloudflare itself, WARP is not designed to solve that.

Cloudflare is explicit that WARP does not provide anonymity, and that it is not designed to prevent the sites you communicate with from identifying you or to let you appear as if you’re in another country. That’s a frank limitation, and it’s also the most honest thing about the product: it avoids the typical VPN-industry overpromises.

Logging and data collection (resolver vs app)

Cloudflare draws a line between:

• the public DNS resolver (1.1.1.1) and its privacy commitments, and
• the 1.1.1.1 application / WARP client, which has its own privacy policy and data handling.

For the public resolver, Cloudflare documents that it deletes Public Resolver Logs within 25 hours and describes the limited purpose (operation/debugging/research). Cloudflare also notes that resolver logs are not shared with third parties except for anonymized logs shared with APNIC.

For the WARP client/app, Cloudflare’s WARP client privacy documentation lists examples of data that may be stored/processed under its privacy policy, including an app installation ID, the amount of data transferred through Cloudflare’s network, and average speed while using the client. That’s not “nothing,” and it’s worth understanding if you expected a traditional “no telemetry” tool.

Cloudflare’s support docs also state you don’t need to provide personal information like name/phone/email to use the app with WARP, and that it does not write user-identifiable log data to disk (in that support article’s framing).

Independent audit / “no-logs audited”

Your database says no-logs audited: true. What we can directly support from sources here: Cloudflare has published a third-party attestation report for the 1.1.1.1 Public DNS Resolver privacy commitments (a report dated 03/30/2020 is available as a PDF in Cloudflare assets). The report describes Cloudflare’s resolver logging approach (including truncated IP addresses for certain logs) and includes an auditor’s opinion on whether Cloudflare’s controls supported its stated commitments over a defined period.

This is meaningful, but be precise about scope: it’s about the public resolver commitments over that period, not a blanket audit of “everything WARP ever does.”

Known issues / criticisms you should take seriously

• Not an anonymity tool. Cloudflare says so directly, and reviewers have echoed it. If someone is shopping for a VPN primarily to hide identity or evade tracking by destinations, WARP is the wrong mental model.
• DNS filtering can misclassify. Cloudflare’s own postmortem on 1.1.1.3 shows that category-based DNS blocking can produce collateral damage.
• The trust shift is real. You’re moving visibility from local networks/ISPs to Cloudflare. That may be a win (especially on hostile Wi‑Fi), but it’s still a central point of trust.

Strengths and Limitations

Strengths

• Clear, documented modes: DNS-only vs full-device tunneling (WARP). This makes it easy to choose between “just fix DNS privacy” and “encrypt the whole connection to Cloudflare.”
• Modern tunneling approach: Cloudflare documents MASQUE support in the WARP app/client, and Cloudflare has written openly about building MASQUE into WARP.
• Short retention window (resolver): Cloudflare documents 25-hour deletion for the resolver’s limited logs.
• Independent attestation (resolver): Cloudflare published a third-party report evaluating its 1.1.1.1 public resolver privacy commitments for a defined period.
• Family filtering options: Malware-only and malware+adult variants exist, with published endpoints/IPs.

Limitations

• Not a geo-unblocking VPN: Cloudflare explicitly says WARP isn’t designed to let you appear in a different country, and doesn’t provide anonymity.
• App telemetry exists: Cloudflare’s WARP client privacy page lists an installation ID and performance/usage metrics as examples of collected data under its policy.
• Paid tier pricing isn’t transparent on the website: Cloudflare indicates WARP+ Unlimited pricing varies by region and is shown in-app; you can’t rely on a single global price.

Who Should Use Cloudflare DNS?

Good fit

1. People who want encrypted DNS quickly without running their own resolver or buying a full VPN subscription: set 1.1.1.1 at the OS/router level or use the app’s DNS-only mode.
2. Laptop/phone users on untrusted Wi‑Fi who mainly want to prevent local network snooping and reduce ISP visibility into DNS and traffic paths (while accepting Cloudflare as the new trusted network).
3. Families who want basic network-wide blocking for known malware/phishing and optional adult content, with minimal configuration.

Not a good fit

1. People who need anonymity or anti-fingerprinting privacy. Cloudflare says WARP isn’t designed for anonymity, and it won’t stop websites from identifying you.
2. People buying a VPN primarily for location shifting (streaming libraries, region-locked services). WARP is not positioned for that use case.
3. Users who don’t want to centralize trust in a single provider. WARP improves privacy against local observers by routing traffic to Cloudflare — but that inherently concentrates visibility at Cloudflare.