Cloudflare DNS Settings: Set Up 1.1.1.1 on Your Device
Configure Cloudflare 1.1.1.1 on Windows, macOS, or Android, choose the intended filtering policy, and verify the resolver connection.
- domains
- guide
For Cloudflare's standard public DNS resolver, use 1.1.1.1 and 1.0.0.1 as the IPv4 addresses. Cloudflare also publishes IPv6 addresses and separate filtering services. Choose the matching set from the official address list.
You can change the resolver on a device without moving a domain to Cloudflare. This guide covers device DNS settings. Domain owners who want authoritative DNS should follow the Cloudflare nameserver guide.
Start with one device and save the existing configuration. Finish by checking the actual connection, rather than assuming that a saved settings screen proves the resolver changed.
Choose the resolver policy before entering addresses
Cloudflare distinguishes the standard resolver from 1.1.1.1 for Families. The standard resolver has no content filtering. The Families options add malware filtering or malware and adult-content filtering. Cloudflare lists separate addresses for each policy.
| Intended policy | IPv4 addresses | IPv6 addresses |
|---|---|---|
| Standard resolver | 1.1.1.1, 1.0.0.1 | 2606:4700:4700::1111, 2606:4700:4700::1001 |
| Block malware | 1.1.1.2, 1.0.0.2 | 2606:4700:4700::1112, 2606:4700:4700::1002 |
| Block malware and adult content | 1.1.1.3, 1.0.0.3 | 2606:4700:4700::1113, 2606:4700:4700::1003 |
Use the complete pair for the chosen service. As practical advice, avoid mixing a filtering address with a nonfiltering address when consistent filtering matters. Write the intended policy beside the saved settings.
Entering an address alone does not document the transport configuration. Review encrypted DNS separately when privacy requirements include encryption between the device and resolver.
Save the existing configuration before making changes
Record whether the device currently receives DNS automatically or uses manual entries. Save any existing addresses and the network adapter name. This record gives you a clear rollback target.
Use a network you are authorized to administer. Ask the responsible administrator before replacing settings on a managed work device. Private applications may depend on the organization's documented DNS configuration.
As an editorial troubleshooting method, change one device first. Test ordinary browsing and any important work applications before applying the change elsewhere. Keep the old configuration available until the trial succeeds.
A resolver change should solve a named DNS requirement. Do not assume that choosing a public resolver guarantees faster downloads or lower in-game latency. Test the task that motivated the change under your actual network conditions.
Windows 11 exposes DNS server assignment for the active adapter
Cloudflare's Windows guide starts with the selected network adapter and the DNS server assignment control. The guide provides the current Windows 11 sequence.
- Open Settings, then Network & internet.
- Select the active Ethernet or Wi-Fi adapter.
- Find DNS server assignment and select Edit.
- Change Automatic (DHCP) to Manual.
- Enable IPv4 and enter the selected resolver pair.
- Configure the matching IPv6 entries when your network uses IPv6.
- Save the change and test the connection.
For the standard policy, the IPv4 pair is 1.1.1.1 and 1.0.0.1. Use the corresponding entries from the table for a Families policy. Follow the operating system's supported encrypted-DNS controls if you require encryption.
Cloudflare documents older Windows versions separately. Use the official Windows setup page when your interface does not match Windows 11.
macOS applies DNS settings to a specific network service
On macOS, Cloudflare configures DNS for a selected service such as Wi-Fi or Ethernet. Cloudflare documents that service-specific scope.
- Open System Settings.
- Select Network and the active network service.
- Select Details, then DNS.
- Save the existing DNS entries in your notes.
- Add the addresses for the selected Cloudflare service.
- Confirm the change and test the connection.
Repeat the review for another network service only when the other service also needs the change. Do not assume that editing Wi-Fi also configures Ethernet.
If an unfamiliar DNS entry returns after saving, inspect the device's managed configuration with the responsible administrator. Repeatedly deleting the entry does not identify which configuration controls the resolver.
Android Private DNS uses a hostname
Cloudflare documents a manual Private DNS option for Android 9 and later. For the standard resolver, the provider hostname is one.one.one.one. The Android guide lists the corresponding filtering hostnames.
Open the Android settings and find Private DNS. Select the provider-hostname option, enter one.one.one.one, and save. Device manufacturers can place the setting under different network menus.
For malware filtering, Cloudflare lists security.cloudflare-dns.com. For malware and adult-content filtering, Cloudflare lists family.cloudflare-dns.com. Choose the hostname that matches your intended policy.
Do not enter a website page path in the hostname field. The hostname identifies the resolver endpoint. Use the official Android guide if your device's interface requests a different input format.
Cloudflare also offers an Android app with DNS and WARP options. Review the selected mode before enabling the app. A manual resolver setting and a broader connection mode require different operating decisions.
Verify the actual connection and keep a rollback route
Open Cloudflare's connection check from the configured device. Cloudflare says the page tests the connection and identifies the serving data center. The verification instructions explain the check's purpose.
Record the observed result and the network used for the test. If you require encrypted DNS, inspect the encryption result as well as the resolver result. Do not infer encryption solely from the IP address you entered.
If browsing fails after the change, restore the recorded DNS configuration and retest. Compare the failing application, network, and active connection settings before trying another resolver.
Cloudflare warns that some public Wi-Fi login pages can conflict with manual configurations. Follow the official device instructions for that case. Do not disable certificate checks or unrelated security controls to force a connection.
Keep the change only after the required applications work and the connection check matches your intended setup. The public resolver comparison guide provides a broader framework if you still need to choose a provider.
For a command-line comparison, use Namefi's DNS command generator to prepare separate system-resolver and Cloudflare queries for the same name and type. Run the commands on the configured device. This comparison does not establish which resolver Chrome or an encrypted-DNS profile uses.
Sources and further reading
Cloudflare lists its resolver addresses
Cloudflare lists its resolver addresses. Checked 2026-10-30.
Cloudflare documents Windows DNS settings
Cloudflare documents Windows DNS settings. Checked 2026-10-30.
Cloudflare documents macOS DNS settings
Cloudflare documents macOS DNS settings. Checked 2026-10-30.
Cloudflare documents Android Private DNS
Cloudflare documents Android Private DNS. Checked 2026-10-30.
Cloudflare explains connection verification
Cloudflare explains connection verification. Checked 2026-10-30.
About the author(s)
Fenwei Bian is a software developer in her thirties who spends her working hours in pull requests and her weekends with her hands in soil or sawdust. Years of open source on GitHub taught her that names are interfaces: a good one is clear, honest about what it does, and kind to whoever has to use it next.
She gardens because it rewards patience and punishes wishful thinking, and she does woodwork because a joint either fits or it doesn't. Both habits show up in how she writes about naming — measure twice, check the source, and don't sand over a rough spot and hope no one notices.
For Namefi she writes about how domain markets actually move, the practical trade-offs of tokenizing and flipping names, and picking a domain you'll still be glad you own in twenty years.