JA EN
shiichan

Cloudflare's Internal DNS is now GA — bringing internal network DNS onto one unified platform!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#infrastructure#security

Hi, it's Shiichan! Today's news from Cloudflare could make internal network DNS management a whole lot simpler.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, Internal DNS is now generally available. Internal DNS provides authoritative and recursive DNS for private networks on the same global network and control plane you already use for public DNS, Zero Trust, and application services.

The story so far

Split-horizon DNS, resolving differently for internal versus external requests, isn't new, but it was often run on separate infrastructure from public DNS. That meant chasing down configuration drift between the two, and policy decisions and audit trails ended up scattered across different places.

What changes

With Internal DNS, internal and external resolution are defined as separate views over the same shared zones, so you manage everything from a single control plane instead of chasing drift. DNS resolution can also be tied to Gateway's resolver policies, so you can control which users and devices resolve against which view using the same Zero Trust mechanisms you already rely on. Having a unified API and audit trail alongside public DNS is a nice quality-of-life win too.

Dive Deep

Setup takes just three steps:

  • Create a zone
  • Create a view
  • Define a resolver policy

Zone creation can be done via the REST API, like this:

POST /zones
{
  "account": {"id": "{ACCOUNT_ID}"},
  "name": "corp.internal",
  "type": "internal"
}

One thing to note: Internal DNS is currently included only with Cloudflare Gateway for Enterprise, not available on every plan. Full setup steps are in the Internal DNS documentation.

Wrap-up

  • Cloudflare's Internal DNS is now generally available
  • It provides authoritative and recursive DNS for private networks on the same global platform and control plane as public DNS
  • Internal and external resolution are managed as separate views over shared zones, unifying the API, audit trail, and policy settings
  • Gateway's resolver policies let you extend Zero Trust controls to DNS itself
  • Setup is three steps: create a zone, create a view, define a resolver policy
  • Currently limited to Cloudflare Gateway for Enterprise customers

This is a great update for infrastructure folks in Zero Trust environments who want to unify their internal network DNS operations!

Related posts