JA EN
shiichan

Surprise Consolidation! Cloudflare Internal DNS Is Now Generally Available!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#infrastructure#security

Hi everyone, it's Shiichan! I found a pretty big networking announcement today, so let's take a proper look at it.

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Blog announced that Cloudflare Internal DNS is now generally available. It brings authoritative and recursive DNS for private networks onto the same global network and control plane that already runs Cloudflare's Zero Trust, networking, and public DNS.

Why it matters

Apparently, a lot of organizations have run DNS in fragmented pieces: one platform for public DNS, another for internal DNS, and yet another cloud-native DNS service per cloud environment — each running separately and hard to manage as a whole. Internal DNS is about pulling that fragmented setup together, so it could meaningfully cut down the burden of network management.

What changes

With Internal DNS, you can manage both public and private resources through a single API, a single audit log, and a single control plane.

Another highlight is support for split-horizon DNS. When you need different resolution results for internal versus external users, you just define separate "views" on the same zone and manage them from one control plane — no more manually syncing multiple systems.

It also integrates with Zero Trust: the Gateway Resolver applies DNS resolution policy using the same mechanism as your existing traffic controls.

Dive Deep

The architecture has two main components.

  • Gateway Resolver — handles recursive resolution and policy evaluation
  • Internal Authoritative DNS — manages authoritative records for internal zones

There are also three objects you work with when configuring it.

  • Internal Zones — hold the authoritative records
  • DNS Views — per-user resolution context
  • Resolver Policies — rules for routing queries

Here's the query flow: a client query is first evaluated by the Gateway Resolver. If it matches a policy, it's routed to the Internal Authoritative DNS for that view; if it's meant to be blocked, it's blocked; otherwise it goes out to public DNS like 1.1.1.1. Record changes propagate across the entire global network within seconds through the unified API.

It supports a wide range of connection methods too — Cloudflare One Client, DoH, DoT, standard DNS, PAC, and Cloudflare WARP. For Enterprise customers, it's included in Cloudflare Gateway at no additional cost.

Wrap-up

  • Cloudflare's Blog: the private-network DNS service Cloudflare Internal DNS is now generally available
  • Manage both public and private resources through a single API, audit log, and control plane
  • Split-horizon DNS is managed per view, eliminating manual syncing
  • Built from two components, Gateway Resolver and Internal Authoritative DNS, with record changes propagating globally within seconds
  • Included in Cloudflare Gateway for Enterprise customers at no extra cost, with broad support for DoH, DoT, WARP, and more

If your organization's DNS setup has grown into a scattered mess of separate systems, this looks like the perfect excuse to pull it all together!

Related posts