DNS Leak Checker
Running live test…

Cloudflare DNS Test – Is 1.1.1.1 Working on Your Device?

Cloudflare's 1.1.1.1 is the world's fastest public DNS resolver and one of the most privacy-focused, used by hundreds of millions of devices worldwide. Many users set up 1.1.1.1 on their devices but are unsure whether it is actually active — especially after system updates, router resets, or VPN configuration changes that can override manual DNS settings. This tool instantly confirms whether 1.1.1.1 is the active DNS resolver on your current connection or whether your device has reverted to your ISP's DNS server. Check your status below in seconds.

What Is Cloudflare 1.1.1.1?

Cloudflare 1.1.1.1 is a free public DNS resolver launched by Cloudflare on April 1, 2018 — a date that caused many to initially dismiss it as an April Fools joke until they discovered it was genuine. The service was designed from the ground up to be the fastest and most privacy-respecting public DNS resolver available, challenging the dominance of Google's 8.8.8.8 which had been the default alternative DNS for years.

Speed-wise, 1.1.1.1 consistently tops independent DNS benchmarks globally. Cloudflare's Anycast network spans data centres in over 300 cities worldwide, meaning your DNS queries are answered by the nearest Cloudflare server rather than being routed to a central location. Average response times for 1.1.1.1 are under 15ms for most users in Europe and North America — significantly faster than typical ISP DNS servers which often respond in 30–80ms.

On privacy, Cloudflare commits to never selling user data or using DNS queries for advertising targeting. Their privacy practices for 1.1.1.1 are audited annually by KPMG — an independent accounting and auditing firm — with published results confirming compliance with their stated policy of not logging user IP addresses or query data beyond what is operationally necessary for the service to function.

Cloudflare also offers enhanced variants of 1.1.1.1 for specific use cases. 1.1.1.2 blocks known malware domains, providing passive malware protection for all devices using it. 1.1.1.3 blocks both malware and adult content, useful for family networks. The 1.1.1.1 app for iOS and Android provides easy configuration alongside an optional WARP feature that encrypts DNS queries even on networks where DNS-over-HTTPS is not natively supported.

If you use a VPN, 1.1.1.1 may not be your active DNS server even if you configured it — VPNs typically override your device's DNS settings to route queries through their own servers. This is expected and desirable behaviour for privacy, but it means your device may switch between Cloudflare DNS and your VPN's DNS depending on whether the VPN is connected. The test above shows which DNS is currently active on your connection.

How to Set Up Cloudflare 1.1.1.1 on Any Device

  1. Step 1 — Set Up 1.1.1.1 on Windows: Open Settings → Network & Internet → your active connection → Hardware properties → Edit DNS server assignment. Change from "Automatic (DHCP)" to "Manual", enable IPv4, enter 1.1.1.1 as preferred DNS and 1.0.0.1 as alternate DNS. On Windows 11, select "DNS over HTTPS (automatic template)" in the encryption dropdown for encrypted queries.
  2. Step 2 — Set Up 1.1.1.1 on macOS: Open System Preferences → Network, select your active connection (Wi-Fi or Ethernet), click Advanced, and navigate to the DNS tab. Click the + button and add 1.1.1.1, then add 1.0.0.1 as a second entry. Remove any existing ISP DNS entries, click OK, then Apply to save the changes.
  3. Step 3 — Set Up 1.1.1.1 on iPhone/iOS: Go to Settings → Wi-Fi, tap the blue ⓘ icon next to your connected network, scroll to DNS and tap "Configure DNS". Switch from Automatic to Manual, delete existing entries, and add 1.1.1.1 and 1.0.0.1. Alternatively, download the free 1.1.1.1 app from the App Store for system-wide configuration across all networks.
  4. Step 4 — Set Up 1.1.1.1 on Android using Private DNS: Go to Settings → Network & Internet → Advanced → Private DNS (on Android 9+). Select "Private DNS provider hostname" and enter one.one.one.one. This applies to all networks automatically and uses DNS-over-TLS for encrypted queries — the recommended method for Android devices.
  5. Step 5 — Set Up 1.1.1.1 on Your Router: Log into your router's admin panel (typically 192.168.1.1 or 192.168.0.1). Find DNS settings under WAN or Internet settings and enter 1.1.1.1 as primary DNS and 1.0.0.1 as secondary DNS. This applies Cloudflare DNS to every device on your network automatically, including smart TVs, consoles, and IoT devices.
  6. Step 6 — Use the 1.1.1.1 App for Mobile (iOS and Android): Download the free 1.1.1.1 app from the App Store or Google Play Store. Open the app and toggle the connection switch to enable Cloudflare DNS — the app configures your device automatically without needing to change any system settings. The app also includes the optional WARP feature for encrypted DNS queries on networks that do not support DNS-over-HTTPS natively.
  7. Step 7 — Enable DNS-over-HTTPS with 1.1.1.1 in Firefox: Open Firefox Settings → Privacy & Security, scroll down to "DNS over HTTPS" and enable it. Select "Cloudflare" from the provider dropdown or enter the custom URL https://cloudflare-dns.com/dns-query. This encrypts all DNS queries made by Firefox through Cloudflare's DoH endpoint, preventing network-level DNS interception.
  8. Step 8 — Verify 1.1.1.1 Is Active Using This Tool: After completing any of the setup methods above, return to the top of this page and click "Re-check". The tool should now show "Cloudflare DNS (1.1.1.1) is active on your device." If your ISP DNS still appears, flush your DNS cache — on Windows: ipconfig /flushdns, on Mac: sudo dscacheutil -flushcache — then check again.

Cloudflare DNS vs Google DNS vs ISP DNS

In terms of raw speed, Cloudflare's 1.1.1.1 holds a consistent edge over Google's 8.8.8.8 in most global benchmarks. Cloudflare's Anycast network with 300+ data centres is specifically optimised for DNS performance, while Google's DNS infrastructure — though massive — serves a broader range of services. Both providers are dramatically faster than typical ISP DNS servers, which often run on older infrastructure with response times 2–5x slower than either public alternative. For users whose primary concern is speed, Cloudflare is the recommended choice with Google as a strong backup.

On privacy, Cloudflare is the clear leader among major public DNS providers. Cloudflare's 1.1.1.1 operates under a strict no-logging policy verified annually by independent auditors, and the company has no advertising business that would benefit from DNS query data. Google's 8.8.8.8 does log some query data — their privacy policy outlines what is retained and for how long — and Google's primary business model is advertising, which raises concerns about how DNS data might be used even if not sold directly. ISP DNS servers offer the worst privacy of all, with most ISPs routinely logging complete query histories and many legally required to retain them.

Reliability is strong across all three options but for different reasons. Cloudflare and Google both offer 100% uptime SLAs backed by redundant global infrastructure — neither has experienced significant outages affecting consumer DNS in recent years. ISP DNS servers are generally reliable for their subscribers but are more prone to regional outages, maintenance windows, and capacity issues during peak usage. Both Cloudflare and Google DNS continue to function even if your ISP experiences DNS-specific infrastructure problems.

For most users, the recommendation is straightforward: switch to Cloudflare 1.1.1.1 for the best combination of speed, privacy, and reliability. Use Google 8.8.8.8 as your secondary DNS for failover. If you need malware blocking, use Cloudflare's 1.1.1.2 variant or Quad9 (9.9.9.9) which blocks malicious domains automatically. If you need content filtering for a family network, use Cloudflare's 1.1.1.3. If you need maximum privacy beyond what any public DNS can provide, use a VPN with private DNS — which is covered in the next section.

Cloudflare DNS and VPNs — Do They Work Together?

When you connect to a VPN, the VPN client overrides your device's DNS settings and routes all DNS queries through the VPN provider's own private DNS servers. This means that even if you have configured 1.1.1.1 as your DNS, it will not be active while the VPN is connected — your queries go through the VPN's DNS instead. This is by design and is actually better for privacy, because your DNS queries travel through the encrypted VPN tunnel and are associated with the VPN server's IP address rather than yours, providing stronger anonymity than Cloudflare DNS alone.

The ideal configuration for most privacy-conscious users is Cloudflare 1.1.1.1 as your default DNS (active when the VPN is disconnected) combined with a VPN that routes DNS through its own private servers (active when the VPN is connected). This way, you always have privacy-respecting DNS regardless of VPN status. To check which DNS is currently active, use the tool at the top of this page or visit the Check DNS Server page for more detail.

However, if the tool above shows your ISP's DNS while your VPN is connected, you have a DNS leak — your VPN is not properly routing your DNS queries through its tunnel. This is a serious privacy vulnerability that exposes your browsing activity to your ISP. Run the full DNS leak test on the homepage to diagnose the issue and check the DNS leak fix guide for step-by-step solutions for your specific VPN and operating system.

We may earn a commission if you purchase through our link

Cloudflare offers two additional DNS resolver variants for content filtering. 1.1.1.2 (secondary: 1.0.0.2) blocks known malware and phishing domains, providing passive security protection for all devices using it — any attempt to visit a domain associated with malware or phishing is blocked at the DNS level before your browser connects. 1.1.1.3 (secondary: 1.0.0.3) blocks both malware domains and adult content, making it suitable for family networks where you want to filter inappropriate content without installing additional software. Both variants provide the same speed and privacy as standard 1.1.1.1 with the added benefit of content filtering applied automatically to every device using them.

Frequently asked questions

Is Cloudflare 1.1.1.1 actually the fastest DNS?

Yes, in the vast majority of independent benchmarks and real-world testing, Cloudflare's 1.1.1.1 is the fastest public DNS resolver available. Cloudflare operates data centres in over 300 cities worldwide using Anycast routing, which directs every query to the geographically nearest server. This distributed architecture consistently delivers response times under 15 milliseconds for most users in Europe, North America, and Asia-Pacific regions. While specific results vary by location, 1.1.1.1 regularly outperforms Google DNS (8.8.8.8), Quad9 (9.9.9.9), and OpenDNS (208.67.222.222) in global benchmarks conducted by DNSPerf and other independent testing services.

Does Cloudflare 1.1.1.1 log my browsing history?

No, Cloudflare commits to never logging the IP addresses of users who query 1.1.1.1 and to never selling query data or using it for advertising. Their privacy practices are audited annually by KPMG, an independent accounting firm, with results published publicly. Cloudflare retains only anonymised, aggregated query data for operational and research purposes — they cannot trace any individual query back to a specific user. This makes 1.1.1.1 one of the most privacy-respecting DNS resolvers available, significantly better than ISP DNS servers which routinely log and retain complete query histories.

What is the difference between 1.1.1.1 and 1.0.0.1?

1.1.1.1 is Cloudflare's primary DNS resolver address and 1.0.0.1 is the secondary (backup) resolver. Both connect to exactly the same Cloudflare DNS infrastructure and provide identical performance, privacy, and functionality. The secondary address exists as a failover — if your device cannot reach 1.1.1.1 for any reason, it will automatically try 1.0.0.1 instead. When configuring Cloudflare DNS on any device, you should enter both addresses: 1.1.1.1 as the primary DNS and 1.0.0.1 as the secondary DNS to ensure continuous DNS resolution even if one address experiences temporary connectivity issues.

Does 1.1.1.1 work with a VPN?

When you connect to a VPN, the VPN client typically overrides your device's DNS settings to route all DNS queries through the VPN provider's own private DNS servers. This means 1.1.1.1 may not be your active DNS resolver while the VPN is connected, even if you configured it manually. This is actually desirable behaviour — your VPN's private DNS provides stronger privacy than Cloudflare DNS because your queries are encrypted within the VPN tunnel and associated with the VPN server's IP rather than yours. When you disconnect the VPN, your device should revert to 1.1.1.1 if it was configured as your default DNS.

What is Cloudflare WARP and is it the same as a VPN?

Cloudflare WARP is a lightweight encryption layer built into the 1.1.1.1 app that encrypts your DNS queries and routes them through Cloudflare's network. WARP is not a full VPN — it does not change your IP address or make you appear to be in a different location, and it does not encrypt all of your internet traffic the way a traditional VPN does. WARP's primary purpose is to encrypt DNS queries on networks where DNS-over-HTTPS is not natively supported, providing a privacy improvement over unencrypted DNS without the overhead of a full VPN connection. Cloudflare also offers WARP+, a paid tier that routes all traffic through Cloudflare's optimised network for faster performance, but even WARP+ is not a replacement for a full VPN service.

Can I use 1.1.1.1 and still get DNS leaks?

Yes, it is possible to have 1.1.1.1 configured as your DNS resolver and still experience DNS leaks in certain scenarios. If you use a VPN that does not properly handle DNS routing, your device may send some queries to 1.1.1.1 and others to your ISP's DNS simultaneously — a DNS leak. On Windows, the Smart Multi-Homed Name Resolution feature can cause DNS queries to be sent to multiple resolvers including your ISP even when Cloudflare is configured as your primary DNS. Additionally, some applications and browsers have their own DNS settings that may override your system configuration. Run the DNS leak test on the homepage to verify your DNS routing is working correctly.

Is Cloudflare DNS free to use?

Yes, Cloudflare's 1.1.1.1 DNS resolver is completely free for all users with no usage limits, account requirements, or premium tiers for the basic DNS service. Cloudflare funds the service through its commercial enterprise products — offering fast, free DNS drives awareness of the Cloudflare brand and attracts enterprise customers to their paid CDN, security, and performance products. The 1.1.1.1 app (iOS and Android) with basic WARP encryption is also free. Cloudflare offers a paid WARP+ subscription for optimised routing performance, but the core DNS resolver service at 1.1.1.1 and 1.0.0.1 is free and has been since launch.

What are Cloudflare's family-safe DNS addresses?

Cloudflare offers two additional DNS resolver variants for content filtering. 1.1.1.2 (secondary: 1.0.0.2) blocks known malware and phishing domains, providing passive security protection for all devices using it — any attempt to visit a domain associated with malware or phishing is blocked at the DNS level before your browser connects. 1.1.1.3 (secondary: 1.0.0.3) blocks both malware domains and adult content, making it suitable for family networks where you want to filter inappropriate content without installing additional software. Both variants provide the same speed and privacy as standard 1.1.1.1 with the added benefit of content filtering applied automatically to every device using them.

Stop leaks for good

A VPN with private DNS on every server, a kill switch and WebRTC protection closes every leak this site tests for.

Get NordVPN →

30-day money-back guarantee · We may earn a commission