# Surprise Consolidation! Cloudflare Internal DNS Is Now Generally Available!

Hi everyone, it's Shiichan! I found a pretty big networking announcement today, so let's take a proper look at it.

## What was announced?

Cloudflare's Blog announced that **Cloudflare Internal DNS** is now generally available. It brings authoritative and recursive DNS for private networks onto the same global network and control plane that already runs Cloudflare's Zero Trust, networking, and public DNS.

## Why it matters

Apparently, a lot of organizations have run DNS in fragmented pieces: one platform for public DNS, another for internal DNS, and yet another cloud-native DNS service per cloud environment — each running separately and hard to manage as a whole. Internal DNS is about pulling that fragmented setup together, so it could meaningfully cut down the burden of network management.

## What changes

With Internal DNS, you can manage both public and private resources through **a single API, a single audit log, and a single control plane**.

Another highlight is support for split-horizon DNS. When you need different resolution results for internal versus external users, you just define separate "views" on the same zone and manage them from one control plane — no more manually syncing multiple systems.

It also integrates with Zero Trust: the Gateway Resolver applies DNS resolution policy using the same mechanism as your existing traffic controls.

## Dive Deep

The architecture has two main components.

- **Gateway Resolver** — handles recursive resolution and policy evaluation
- **Internal Authoritative DNS** — manages authoritative records for internal zones

There are also three objects you work with when configuring it.

- **Internal Zones** — hold the authoritative records
- **DNS Views** — per-user resolution context
- **Resolver Policies** — rules for routing queries

Here's the query flow: a client query is first evaluated by the Gateway Resolver. If it matches a policy, it's routed to the Internal Authoritative DNS for that view; if it's meant to be blocked, it's blocked; otherwise it goes out to public DNS like 1.1.1.1. Record changes propagate across the entire global network within seconds through the unified API.

It supports a wide range of connection methods too — Cloudflare One Client, DoH, DoT, standard DNS, PAC, and Cloudflare WARP. For Enterprise customers, it's included in Cloudflare Gateway at no additional cost.

## Wrap-up

- Cloudflare's Blog: the private-network DNS service **Cloudflare Internal DNS** is now generally available
- Manage both public and private resources through a single API, audit log, and control plane
- Split-horizon DNS is managed per view, eliminating manual syncing
- Built from two components, Gateway Resolver and Internal Authoritative DNS, with record changes propagating globally within seconds
- Included in Cloudflare Gateway for Enterprise customers at no extra cost, with broad support for DoH, DoT, WARP, and more

If your organization's DNS setup has grown into a scattered mess of separate systems, this looks like the perfect excuse to pull it all together!