1.1.1.1: Cloudflare public DNS, variants, logs
1.1.1.1 is Cloudflare's free public DNS resolver on network AS13335. Its addresses, the 1.1.1.2 and 1.1.1.3 family filters, encrypted DNS and what it logs.
1.1.1.1 is the public DNS resolver of Cloudflare, free for anyone to use instead of their internet provider's resolver. It runs on Cloudflare's network, AS13335, in hundreds of cities, and its reverse DNS name is one.one.one.one. Cloudflare built it in partnership with APNIC, the regional internet registry for Asia-Pacific: the 1.1.1.0/24 block is registered to APNIC Labs as a research prefix and routed by Cloudflare.
Addresses
Cloudflare gives two addresses per resolver, for redundancy:
| Resolver | IPv4 | IPv6 |
|---|---|---|
| 1.1.1.1, no filtering | 1.1.1.1, 1.0.0.1 | 2606:4700:4700::1111, 2606:4700:4700::1001 |
| Families: blocks malware | 1.1.1.2, 1.0.0.2 | 2606:4700:4700::1112, 2606:4700:4700::1002 |
| Families: blocks malware and adult content | 1.1.1.3, 1.0.0.3 | 2606:4700:4700::1113, 2606:4700:4700::1003 |
The standard resolver does not block or filter anything. The two Families resolvers answer 0.0.0.0 for a domain they classify as malicious (setup).
Encrypted DNS
From Cloudflare's network operators page and DNS over TLS page:
| Resolver | DNS over HTTPS | DNS over TLS (port 853) |
|---|---|---|
| 1.1.1.1 | https://cloudflare-dns.com/dns-query | one.one.one.one |
| Families, malware | https://security.cloudflare-dns.com/dns-query | security.cloudflare-dns.com |
| Families, malware and adult | https://family.cloudflare-dns.com/dns-query | family.cloudflare-dns.com |
The DoH endpoint also answers in JSON, handy for a quick check with curl:
curl -s -H "accept: application/dns-json" "https://cloudflare-dns.com/dns-query?name=host.sh&type=A"
Where is 1.1.1.1?
In every city where Cloudflare runs the resolver. The same address is announced from all of them and routing takes your query to one of them, usually one near you, so an IP location lookup can give only one place for 1.1.1.1 while you are answered elsewhere. Cloudflare's troubleshooting page documents a CHAOS query that identifies the server that answered you. In host.sh's own test from Lisbon on 28 October 2026 it returned lis01:
dig +short CHAOS TXT id.server @1.1.1.1
On Windows: nslookup -class=chaos -type=txt id.server 1.1.1.1. Cloudflare's diagnostic page is one.one.one.one/help.
What Cloudflare logs
From the 1.1.1.1 privacy commitments:
- The querying IP address is not written to non-volatile storage, except in packet samples of at most 0.05% of traffic, used for troubleshooting and DoS mitigation.
- Resolver logs, with addresses truncated (last octet for IPv4, last 80 bits for IPv6), are deleted within 25 hours.
- Cloudflare does not sell the data to advertisers, and has the practices audited by one of the four large accounting firms.
Look up 1.1.1.1 with the host.sh API
The API's lookup of 1.1.1.1, like that of any address, returns its network (connection.isp), reverse DNS (connection.hostname, with hostname=1) and location fields. Looking up an address other than your own needs a token:
curl -H "Authorization: Bearer YOUR_TOKEN" "https://api.host.sh/v2/lookup/1.1.1.1?hostname=1"
See Lookup and Response fields. For your own address, open the IP lookup or run curl host.sh.
FAQ
Who owns 1.1.1.1?
Cloudflare runs the 1.1.1.1 resolver on its network AS13335. The 1.1.1.0/24 block itself is registered to APNIC Labs, the research arm of the Asia-Pacific internet registry, which partners with Cloudflare on the resolver.
What is the difference between 1.1.1.1, 1.1.1.2 and 1.1.1.3?
1.1.1.1 resolves everything without filtering. 1.1.1.2 blocks malware, and 1.1.1.3 blocks malware and adult content. Their second addresses are 1.0.0.1, 1.0.0.2 and 1.0.0.3.
Does 1.1.1.1 log my IP address?
Cloudflare says it does not write the querying IP address to disk, apart from samples of at most 0.05% of traffic for troubleshooting, and deletes its truncated resolver logs within 25 hours.
What is the IPv6 address of 1.1.1.1?
2606:4700:4700::1111 and 2606:4700:4700::1001.
This page as Markdown: /ip/1.1.1.1/index.md