# 1.1.1.1: Cloudflare public DNS, variants, logs | host.sh

> 1.1.1.1 is Cloudflare's free public DNS resolver on network AS13335. Its addresses, the 1.1.1.2 and 1.1.1.3 family filters, encrypted DNS and what it logs.

1.1.1.1 is the public DNS resolver of [Cloudflare](https://developers.cloudflare.com/1.1.1.1/), free for anyone to use instead of their internet provider's resolver. It runs on Cloudflare's network, AS13335, in hundreds of cities, and its reverse DNS name is `one.one.one.one`. Cloudflare built it in partnership with APNIC, the regional internet registry for Asia-Pacific: the 1.1.1.0/24 block is registered to APNIC Labs as a research prefix and routed by Cloudflare.

## Addresses

Cloudflare gives [two addresses per resolver](https://developers.cloudflare.com/1.1.1.1/ip-addresses/), for redundancy:

| Resolver | IPv4 | IPv6 |
|---|---|---|
| 1.1.1.1, no filtering | `1.1.1.1`, `1.0.0.1` | `2606:4700:4700::1111`, `2606:4700:4700::1001` |
| Families: blocks malware | `1.1.1.2`, `1.0.0.2` | `2606:4700:4700::1112`, `2606:4700:4700::1002` |
| Families: blocks malware and adult content | `1.1.1.3`, `1.0.0.3` | `2606:4700:4700::1113`, `2606:4700:4700::1003` |

The standard resolver does not block or filter anything. The two Families resolvers answer `0.0.0.0` for a domain they classify as malicious ([setup](https://developers.cloudflare.com/1.1.1.1/setup/)).

## Encrypted DNS

From Cloudflare's [network operators page](https://developers.cloudflare.com/1.1.1.1/infrastructure/network-operators/) and [DNS over TLS page](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/):

| Resolver | DNS over HTTPS | DNS over TLS (port 853) |
|---|---|---|
| 1.1.1.1 | `https://cloudflare-dns.com/dns-query` | `one.one.one.one` |
| Families, malware | `https://security.cloudflare-dns.com/dns-query` | `security.cloudflare-dns.com` |
| Families, malware and adult | `https://family.cloudflare-dns.com/dns-query` | `family.cloudflare-dns.com` |

The DoH endpoint also answers in [JSON](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/), handy for a quick check with curl:

```sh
curl -s -H "accept: application/dns-json" "https://cloudflare-dns.com/dns-query?name=host.sh&type=A"
```

## Where is 1.1.1.1?

In every city where Cloudflare runs the resolver. The same address is announced from all of them and routing takes your query to one of them, usually one near you, so an IP location lookup can give only one place for 1.1.1.1 while you are answered elsewhere. Cloudflare's [troubleshooting page](https://developers.cloudflare.com/1.1.1.1/troubleshooting/) documents a CHAOS query that identifies the server that answered you. In host.sh's own test from Lisbon on 28 October 2026 it returned `lis01`:

```text
dig +short CHAOS TXT id.server @1.1.1.1
```

On Windows: `nslookup -class=chaos -type=txt id.server 1.1.1.1`. Cloudflare's diagnostic page is [one.one.one.one/help](https://one.one.one.one/help).

## What Cloudflare logs

From the [1.1.1.1 privacy commitments](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/):

- The querying IP address is not written to non-volatile storage, except in packet samples of at most 0.05% of traffic, used for troubleshooting and DoS mitigation.
- Resolver logs, with addresses truncated (last octet for IPv4, last 80 bits for IPv6), are deleted within 25 hours.
- Cloudflare does not sell the data to advertisers, and has the practices audited by one of the four large accounting firms.

## Look up 1.1.1.1 with the host.sh API

The API's lookup of 1.1.1.1, like that of any address, returns its network (`connection.isp`), reverse DNS (`connection.hostname`, with `hostname=1`) and location fields. Looking up an address other than your own needs a token:

```sh
curl -H "Authorization: Bearer YOUR_TOKEN" "https://api.host.sh/v2/lookup/1.1.1.1?hostname=1"
```

See [Lookup](https://www.host.sh/docs/lookup/index.md) and [Response fields](https://www.host.sh/docs/fields/index.md). For your own address, open the [IP lookup](https://www.host.sh/lookup/index.md) or run `curl host.sh`.

## FAQ

### Who owns 1.1.1.1?

Cloudflare runs the 1.1.1.1 resolver on its network AS13335. The 1.1.1.0/24 block itself is registered to APNIC Labs, the research arm of the Asia-Pacific internet registry, which partners with Cloudflare on the resolver.

### What is the difference between 1.1.1.1, 1.1.1.2 and 1.1.1.3?

1.1.1.1 resolves everything without filtering. 1.1.1.2 blocks malware, and 1.1.1.3 blocks malware and adult content. Their second addresses are 1.0.0.1, 1.0.0.2 and 1.0.0.3.

### Does 1.1.1.1 log my IP address?

Cloudflare says it does not write the querying IP address to disk, apart from samples of at most 0.05% of traffic for troubleshooting, and deletes its truncated resolver logs within 25 hours.

### What is the IPv6 address of 1.1.1.1?

2606:4700:4700::1111 and 2606:4700:4700::1001.