Cloudflare DNS

What Cloudflare DNS actually is

Cloudflare DNS is the authoritative DNS service that sits at the foundation of everything else Cloudflare sells. You delegate your domain's nameservers to Cloudflare, and Cloudflare answers every DNS query for that domain from its global anycast network. The service is free on every plan — including accounts that never buy anything — with DNSSEC, DDoS protection for the DNS layer, and an API included at no cost. In our view it is the default choice for authoritative DNS for almost everyone, and the interesting questions are not "is it good" but "what are you trading away" and "which numbers on its product page actually mean something."

One clarification first, because the marketing blurs it constantly. Cloudflare runs two different DNS products. The authoritative service reviewed here answers queries for your domain. Separately, 1.1.1.1 is Cloudflare's public recursive resolver, which anyone can point any device at, launched on April 1, 2018. Speed claims about 1.1.1.1 being "the fastest DNS" describe the resolver benchmark, not your domain's authoritative responses. Authoritative responses are also served from the same 330-plus city network, so the performance is genuinely good — but we would not repeat a resolver benchmark as an authoritative-DNS claim. The product page itself claims "fastest authoritative DNS," and we would treat that as vendor positioning rather than a measured fact on your domain.

The mechanics are conventional in the best way. Anycast routing means every resolver on earth talks to the nearest Cloudflare facility. Records are managed through a dashboard, a full REST API, and a Terraform provider. Changes propagate quickly in practice. DNSSEC is available universally — one-click signing with automatic DS record handling at supported registrars — which is not true of every free DNS host. Secondary DNS is offered for people running their own primary, and DNS-only (grey-clouded) records let you use Cloudflare purely as a DNS host without proxying traffic, which matters if you want DNS here but mail and web elsewhere.

Pricing: what you really pay

Zero. That is the honest summary: Cloudflare DNS is free forever, with no record limits that matter in practice and no per-query billing. Authoritative DNS is included in every plan from Free to Enterprise; the paid application plans (Pro at $20 per month billed annually, or $25 billed monthly; Business at $200 per month billed annually ($2,400 per year) or $250 billed monthly; Enterprise custom) buy you CDN and WAF features, not more DNS. If all you want is DNS hosting, you can stop reading the pricing section and pay nothing.

What you actually pay is attention and lock-in. Cloudflare's free tier exists to route your traffic through its network — when a record is proxied (orange cloud), Cloudflare sees your traffic and can upsell you on the products that inspect it. That is the trade, and Cloudflare is transparent about the business model in ways many free-DNS providers are not. There is no bait pricing here: the DNS product does not quietly degrade after a trial, and we have found no record-count or query-count limits that a normal domain would hit.

The one contractual item worth knowing is the SLA. Cloudflare offers no uptime guarantee on Free or Pro plans. The Business plan carries a 100 percent uptime guarantee with service credits at 1x the monthly fee; Enterprise agreements carry 10x credits standard, 25x with premium success. So if DNS availability is contractually critical to you — resellers, SaaS platforms pointing customer domains, anything with uptime penalties — the protection is not free. It comes attached to a Business or Enterprise subscription, not to the DNS product itself. In our view that is fair, but you should decide consciously rather than assume "four nines" is contractual.

Performance & infrastructure

The network is the product. Cloudflare reports 330-plus data centers across more than 120 countries, and every DNS query is answered from the closest one. There is no region to pick, no anycast vs unicast decision, no "DNS hosting region" setting to get wrong. For a global audience this is the simplest possible performance configuration, which is a large part of why the service became the default.

Reliability follows from scale and from operational transparency. Cloudflare publishes a public status page and writes unusually detailed incident postmortems for an infrastructure company. The DNS service has carried enormous query loads for a long time without the kind of slow-burn degradation that plagues smaller DNS hosts at renewal time. That said, its scale cuts the other way too: a Cloudflare control-plane or network incident takes every domain you host there down together, and DNS is precisely the layer where you cannot route around your provider without having planned ahead. Our standing advice is to keep a secondary copy of your zone somewhere else — a zone export and a documented failover path — regardless of who your DNS host is.

Feature depth is solid but tiered. DNS analytics exist but the useful granularity sits higher up the plan ladder. Rate limiting and WAF rules are attached to proxied records rather than to DNS itself, so their availability tracks the application plan, not the DNS product. On the free tier you get everything that makes DNS work correctly: DNSSEC, an API, unlimited records, and DDoS protection aimed at the DNS layer. We consider that complete for the job.

Where it falls short

Privacy is the fair criticism, and it is worth stating plainly. As an authoritative host and proxy, Cloudflare necessarily processes query data and, for proxied records, request data. If your requirement is "nobody but my registrar and my host sees my DNS traffic," a free US-headquartered network company with law-enforcement processes is a specific choice with specific trade-offs. Cloudflare publishes transparency reports and a detailed privacy policy, which is more than most providers offer, but the architectural fact stands.

There is also account coupling. Registrar integration works best when nameservers stay on Cloudflare, and moving a domain away from Cloudflare DNS while keeping other Cloudflare products is possible but less tidy. The dashboard is dense; finding the DNS settings themselves is easy, but the surrounding surface — Zero Trust, Workers, R2 — can make a DNS-only user feel like they wandered into a platform sale.

The SLA gap is the second real limitation. Free DNS with no contractual commitment is fine for a portfolio or a blog. It is a genuine gap for businesses that would face contractual penalties for DNS downtime. And the marketing-speed claims deserve the skepticism we gave them above: we know of no independent, current measurement of authoritative response times across providers that we would stake our name on, so we make no latency claim here.

Finally, one practical note: all domains registered or transferred through Cloudflare Registrar must use Cloudflare nameservers. That is fine if you have chosen Cloudflare DNS anyway — but it removes the option of a mixed setup.

Who should pick this

Our pick for /category/dns-providers for nearly every reader. Personal domains, side projects, small business sites: use it free and never think about DNS again. Teams already in the Cloudflare ecosystem get consolidation benefits that are real — one account, one API, one Terraform provider for DNS, CDN and WAF. Resellers and platforms pointing customer domains at your service should run the SLA math and look at the Business plan or a secondary DNS arrangement.

Who should look elsewhere: organizations with data-residency requirements that rule out US-based processing; teams that want a contractual SLA on a free product (that does not exist anywhere, so pick a paid DNS host with an SLA instead); and operators who deliberately keep DNS at a separate vendor from their CDN to avoid single-vendor concentration. That last group is smaller than the internet commentariat thinks, but it is not wrong.

If you are moving domains between registrars anyway, read our /category/domain-registrars comparison alongside this — Cloudflare's registrar pricing at cost pairs naturally with its free DNS, and the combination is one of the few genuine "no downsides we can find" stacks in infrastructure.

Key takeaways

• Free authoritative DNS on every plan, with DNSSEC, an API and DNS-layer DDoS protection included.
• Served from 330+ cities in 120+ countries via anycast; no region configuration to get wrong.
• No uptime SLA on Free or Pro; the 100 percent guarantee starts with the Business plan (1x credits), 10x/25x on Enterprise.
• Distinguish the authoritative service from the 1.1.1.1 resolver (April 2018) — speed claims usually describe the resolver.
• Privacy and vendor-concentration trade-offs are real; keep a zone export and a documented failover path.
• Best paired with Cloudflare Registrar's at-cost domain pricing if you want one account for the whole stack.

Sources

• https://developers.cloudflare.com/dns/faq/
• https://www.cloudflare.com/application-services/products/dns/
• https://www.cloudflare.com/plans/faq/
• https://www.cloudflare.com/plans/
• https://www.cloudflare.com/network/
• https://www.cloudflare.com/our-story/
• https://www.cloudflare.com/press/press-releases/2018/1-1-1-1-launches-to-make-the-internet-faster-and-more-private-for-everyone/