How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
Five Rust-level memory optimizations to the DNS cache layout of Big Pineapple cut per-entry memory by 56%, freeing approximately 100 TB of memory across Cloudflare's fleet.
TAG
1.1.1.1
A broken DNSSEC rollover took down .al. Now 1.1.1.1 tells you when validation is bypassed
When a failed DNSSEC key rollover took down the .al TLD, we deployed a Negative Trust Anchor to restore resolution. This time, though, clients didn't have to take our word for it: 1.1.1.1 returned EDE 33, a new DNS error code that signals directly in the response that DNSSEC validation was bypassed.
When DNSSEC goes wrong: how we responded to the .de TLD outage
On May 5, 2026, DENIC published broken DNSSEC signatures for the .de TLD, making millions of domains unreachable. Here's what 1.1.1.1 saw, how serve stale cushioned the impact, and how we restored resolution.
Our ongoing commitment to privacy for the 1.1.1.1 public DNS resolver
Eight years ago, we launched 1.1.1.1 to build a faster, more private Internet. Today, we’re sharing the results of our latest independent examination. The result: our privacy protections are working exactly as promised.
What came first: the CNAME or the A record?
A recent change to 1.1.1.1 accidentally altered the order of CNAME records in DNS responses, breaking resolution for some clients. This post explores the technical root cause, examines the source code of affected resolvers, and dives into the inherent ambiguities of the DNS RFCs.
What we know about Iran’s Internet shutdown
Cloudflare Radar data shows Internet traffic from Iran has effectively dropped to zero since January 8, signaling a complete shutdown in the country and disconnection from the global Internet.
From .com to .anything: introducing Top-Level Domain (TLD) insights on Cloudflare Radar
Cloudflare Radar has launched a new Top-Level Domain (TLD) page, providing insights into TLD popularity, traffic, and security. The top-ranking TLD may come as a surprise.
15 years of helping build a better Internet: a look back at Birthday Week 2025
Rust-powered core systems, post-quantum upgrades, developer access for students, PlanetScale integration, open-source partnerships, and our biggest internship program ever — 1,111 interns in 2026.
Securing today for the quantum future: WARP client now supports post-quantum cryptography (PQC)
To prepare for a future where powerful quantum computers come online, we've upgraded our WARP client with post-quantum cryptography.
Addressing the unauthorized issuance of multiple TLS certificates for 1.1.1.1
Unauthorized TLS certificates were issued for 1.1.1.1 by a Certification Authority without permission from Cloudflare. These rogue certificates have now been revoked.
Cloudflare 1.1.1.1 incident on July 14, 2025
July 14th, 2025, Cloudflare made a change to our service topologies that caused an outage for 1.1.1.1 on the edge, causing downtime for 62 minutes for customers using the 1.1.1.1 public DNS Resolver.
Some TXT about, and A PTR to, new DNS insights on Cloudflare Radar
The new Cloudflare Radar DNS page provides increased visibility into aggregate traffic and usage trends seen by our 1.1.1.1 resolver
No hallucinations here: track the latest AI trends with expanded insights on Cloudflare Radar
Today, we are launching a new dedicated “AI Insights” page on Cloudflare Radar that incorporates this graph and builds on it with additional metrics.
What’s new in Cloudflare: MASQUE now powers 1.1.1.1 & WARP apps, DEX now generally available with Remote Captures
This roundup blog post shares the latest new features and capabilities at Cloudflare.
Mari Galicer and Guy Nir
Cloudflare partners with Internet Service Providers and network equipment providers to deliver a safer browsing experience to millions of homes
Cloudflare is extending the use of our public DNS resolver through partnering with ISPs and network providers to deliver a safer browsing experience directly to families. Join us in protecting every Internet user from unsafe content with the click of a button, powered by 1.1.1.1 for Families.
Cloudflare 1.1.1.1 incident on June 27, 2024
On June 27, 2024, a small number of users globally may have noticed that 1.1.1.1 was unreachable or degraded. The root cause was a mix of BGP (Border Gateway Protocol) hijacking and a route leak
Zero Trust WARP: tunneling with a MASQUE
This blog discusses the introduction of MASQUE to Zero Trust WARP and how Cloudflare One customers will benefit from this modern protocol
Remediating new DNSSEC resource exhaustion vulnerabilities
Cloudflare recently fixed two critical DNSSEC vulnerabilities: CVE-2023-50387 and CVE-2023-50868. Both of these vulnerabilities can exhaust computational resources of validating DNS resolvers. These vulnerabilities do not affect our Authoritative DNS or DNS firewall products
