Cloudflare launches Internal DNS for private networks

Cloudflare has released Internal DNS, a service that unifies public and private DNS management on its global network. The offering targets enterprises still operating separate platforms for internal and external DNS resolution, a setup that often leads to configuration drift and outages.

What Cloudflare Internal DNS provides

Internal DNS combines two components: Gateway Resolver for recursive resolution and policy enforcement, and Internal Authoritative DNS for serving private zone records. Both run on Cloudflare’s existing infrastructure, which already powers 1.1.1.1 and the company’s public DNS services.

The service introduces three core objects: Internal Zones for private records, DNS Views to group zones by resolution context, and Resolver Policies to route queries based on user or device attributes. Zone references allow shared zones like intranet.local to be defined once and reused across views, eliminating duplication in split-horizon setups. Changes to records propagate globally within seconds through Cloudflare’s unified API and replication system.

Queries follow a three-step path: policy evaluation at the Gateway Resolver, internal resolution if a matching view exists, or fallback to public DNS. This design allows a single resolver to handle both private and public names without client-side configuration changes.

Integration with existing Cloudflare services

Internal DNS is included at no additional cost for Enterprise customers using Cloudflare Gateway. It extends the company’s Connectivity Cloud platform, which already combines Zero Trust security, WAN connectivity, and application acceleration. The service works with any Cloudflare connectivity method that routes DNS traffic through Gateway, including the Cloudflare One Client, DNS over HTTPS/TLS, standard port 53, and Cloudflare WAN.

For organizations using Cloudflare WAN, devices on connected networks can resolve internal hostnames without requiring the Cloudflare One Client on each endpoint. This provides consistent DNS resolution across remote users, branch offices, data centers, and cloud environments.

Operational implications

The launch addresses long-standing operational challenges in enterprise DNS management. Legacy setups often require separate platforms for public DNS, internal DNS, and cloud-native DNS services, each with distinct security policies and control planes. Split-horizon DNS adds further complexity, as internal and external views of the same hostname must remain synchronized to avoid resolution failures.

Cloudflare’s approach consolidates these functions into a single platform with unified APIs, audit trails, and policy enforcement. The company positions this as a way to retire hardware appliances, legacy DNS servers, and cloud-locked resolvers, replacing them with a globally distributed service that requires no capacity provisioning.

Adoption and next steps

Enterprise customers with Cloudflare Gateway access can enable Internal DNS through the Cloudflare dashboard under the Networking section. Setup involves creating an internal zone, defining a DNS view, and configuring a resolver policy to route relevant traffic. Full Terraform support is available, with changes following the same propagation path as manual updates.

Cloudflare has indicated that tighter integration between DNS, networking, and Zero Trust policy is on the roadmap. Future updates may allow a single platform to handle hostname resolution, service reachability, and access control decisions, further reducing the number of disconnected systems in enterprise networks.