[metadata]
algolia_content_type: Concept
algolia_product_filter: 1.1.1.1 (DNS Resolver)
description: How 1.1.1.1 selects authoritative nameservers, retries failed queries, and determines which response to return.
generator: Astro v7.2.0
generator: Nimbus v0.2.2
image: https://developers.cloudflare.com/og-docs.png
og:description: How 1.1.1.1 selects authoritative nameservers, retries failed queries, and determines which response to return.
og:image: https://developers.cloudflare.com/og-docs.png
og:locale: en
og:site_name: Cloudflare Docs
og:title: Upstream resolution
og:title: Upstream resolution · Cloudflare 1.1.1.1 docs
og:type: article
og:url: https://developers.cloudflare.com/1.1.1.1/upstream-resolution/
pcx_additional_products: 1.1.1.1
pcx_content_group: Consumer services
pcx_content_type: Concept
pcx_last_modified: 112
pcx_product: 1.1.1.1 (DNS Resolver)
twitter:card: summary_large_image
twitter:image: https://developers.cloudflare.com/og-docs.png
twitter:site: @cloudflare
viewport: width=device-width, initial-scale=1

[canonical-links]
https://developers.cloudflare.com/1.1.1.1/upstream-resolution/

[document-links]
/
1.1.1.1 (DNS Resolver): /1.1.1.1/
1.1.1.1 Public DNS Resolver: /1.1.1.1/privacy/public-dns-resolver/
1.1.1.1 llms-full.txt ↗: /1.1.1.1/llms-full.txt
1.1.1.1 llms.txt ↗: /1.1.1.1/llms.txt
AI Security: https://www.cloudflare.com/solutions/ai-security/
API: /api/
About DoH: /1.1.1.1/encryption/dns-over-https/
About: https://www.cloudflare.com/about/
Agent setup ↗: /agent-setup/
Agent setup: /agent-setup/
Android: /1.1.1.1/setup/android/
App innovation report: https://www.cloudflare.com/resource/app-innovation-report/
Athenian Project: https://www.cloudflare.com/athenian/
Azure: /1.1.1.1/setup/azure/
BigPineapple architecture blog post ↗: https://blog.cloudflare.com/big-pineapple-intro/
Blog: https://blog.cloudflare.com/
Careers: https://www.cloudflare.com/careers/
Case studies: https://www.cloudflare.com/case-studies/
Changelog: /1.1.1.1/changelog/
Changelog: /changelog/
Cloudflare AI Cloud: https://www.cloudflare.com/solutions/ai/
Cloudflare Docs llms-full.txt ↗: /llms-full.txt
Cloudflare Docs llms.txt ↗: /llms.txt
Cloudflare Radar: https://radar.cloudflare.com/
Cloudflare Resolver for Firefox: /1.1.1.1/privacy/cloudflare-resolver-firefox/
Cloudflare Skills ↗: https://github.com/cloudflare/skills
Cloudflare for Campaigns: https://www.cloudflare.com/campaigns/
Code Mode MCP Server ↗: https://github.com/cloudflare/mcp
Community: https://community.cloudflare.com/
Compliance resources: https://www.cloudflare.com/trust-hub/compliance-resources/
Configure DoH on your browser: /1.1.1.1/encryption/dns-over-https/encrypted-dns-browsers/
Connect to 1.1.1.1 using DoH clients: /1.1.1.1/encryption/dns-over-https/dns-over-https-client/
Contact sales: https://www.cloudflare.com/resource/contact-enterprise-sales/
DNS Wireformat: /1.1.1.1/encryption/dns-over-https/make-api-requests/dns-wireformat/
DNS in Google Sheets: /1.1.1.1/additional-options/dns-in-google-sheets/
DNS over Discord: /1.1.1.1/additional-options/dns-over-discord/
DNS over TLS: /1.1.1.1/encryption/dns-over-tls/
DNS over Tor: /1.1.1.1/additional-options/dns-over-tor/
DNSKEY: /1.1.1.1/encryption/dnskey/
Data Protection: https://www.cloudflare.com/trust-hub/gdpr/
Directory: /directory/
Docs: /
Documentation: https://developers.cloudflare.com/
Domain name search: https://domains.cloudflare.com/
Domain-specific MCP Servers ↗ MCP: https://github.com/cloudflare/mcp-server-cloudflare
Edit page: https://github.com/cloudflare/cloudflare-docs/edit/production/src/content/docs/1.1.1.1/upstream-resolution.mdx
Events: https://www.cloudflare.com/events/
Extended DNS error codes: /1.1.1.1/infrastructure/extended-dns-error-codes/
FAQ: /1.1.1.1/faq/
Find a partner: https://partnerlocator.cloudflare.com/dashboard
Frontend Development Platform: https://www.cloudflare.com/solutions/frontends/
Gaming consoles: /1.1.1.1/setup/gaming-consoles/
General: /1.1.1.1/setup/
Global network: https://www.cloudflare.com/network/
Google Cloud: /1.1.1.1/setup/google-cloud/
Home: /
IP addresses: /1.1.1.1/ip-addresses/
Impact/ESG: https://www.cloudflare.com/impact/
Investors: https://cloudflare.net/
Learning center: https://www.cloudflare.com/learning/
Linux: /1.1.1.1/setup/linux/
Log In: https://dash.cloudflare.com/login
Log in Dashboard: https://dash.cloudflare.com/
Multi-Tenant Platform Development: https://www.cloudflare.com/solutions/platforms/
Network operators: /1.1.1.1/infrastructure/network-operators/
Next Network operators: /1.1.1.1/infrastructure/network-operators/
Oblivious DoH: /1.1.1.1/encryption/oblivious-dns-over-https/
Overview: /1.1.1.1
Overview: /1.1.1.1/encryption/
Overview: /1.1.1.1/encryption/dns-over-https/make-api-requests/
Overview: /1.1.1.1/privacy/
Partners: https://www.cloudflare.com/partners/
Plans: https://www.cloudflare.com/plans/
Press kit: https://www.cloudflare.com/press/press-kit/
Press: https://www.cloudflare.com/press/
Previous DNSKEY: /1.1.1.1/encryption/dnskey/
Privacy policy: https://www.cloudflare.com/policies/privacy/
Project Fairshot: https://www.cloudflare.com/fair-shot/
Project Galileo: https://www.cloudflare.com/galileo/
Report abuse: https://www.cloudflare.com/trust-hub/abuse-approach/
Report issue: https://github.com/cloudflare/cloudflare-docs/issues/new/choose
Report security issues: https://www.cloudflare.com/disclosure/
Responsible AI: https://www.cloudflare.com/trust-hub/responsible-ai/
Router: /1.1.1.1/setup/router/
SDKs: /fundamentals/api/reference/sdks/
SLA and support: /1.1.1.1/infrastructure/sla-and-support/
SSE and SASE platform: https://www.cloudflare.com/sase/
Start Building: https://dash.cloudflare.com/sign-up
Startups: https://www.cloudflare.com/startups/
Status: https://www.cloudflarestatus.com/
Support for IPv6-only networks: /1.1.1.1/infrastructure/ipv6-networks/
Support: https://support.cloudflare.com/
Terms of use: /1.1.1.1/terms-of-use/
Terms of use: https://www.cloudflare.com/policies/terms/
Trademark: https://www.cloudflare.com/trademark/
Transparency report: https://www.cloudflare.com/transparency/
Troubleshooting: /1.1.1.1/troubleshooting/
Trust Hub: https://www.cloudflare.com/trust-hub/
Under attack?: https://www.cloudflare.com/under-attack-hotline/
Upstream resolution: /1.1.1.1/upstream-resolution/
Using JSON: /1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/
Verify connection: /1.1.1.1/check/
View as Markdown: index.md
Web Security Platform: https://www.cloudflare.com/solutions/security/
Windows: /1.1.1.1/setup/windows/
https://github.com/cloudflare/cloudflare-docs
iOS: /1.1.1.1/setup/ios/
locally hosted copies of the root zone file ↗: https://blog.cloudflare.com/f-root/
macOS: /1.1.1.1/setup/macos/

[structured-data]
{"@context":"https://schema.org","@id":"https://developers.cloudflare.com/1.1.1.1/upstream-resolution/#page","@type":"TechArticle","dateModified":"2026-04-30","description":"How 1.1.1.1 selects authoritative nameservers, retries failed queries, and determines which response to return.","headline":"Upstream resolution · Cloudflare 1.1.1.1 docs","image":"https://developers.cloudflare.com/og-docs.png","inLanguage":"en","isPartOf":{"@id":"https://developers.cloudflare.com/#website","@type":"WebSite","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"url":"https://developers.cloudflare.com/1.1.1.1/upstream-resolution/"}

[content]
Upstream resolution · Cloudflare 1.1.1.1 docs
Skip to content
Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/1.1.1.1/llms.txt
Use this file to discover all available pages before exploring further.
Docs
Directory
API
SDKs
Changelog
Search
Ctrl
K
Log in
Dashboard
1.1.1.1 (DNS Resolver)
/
Overview
IP addresses
Set up
General
Android
Azure
Gaming consoles
Google Cloud
iOS
Linux
macOS
Router
Windows
Encryption
Overview
DNS over TLS
DNS over HTTPS
About DoH
Make API requests to 1.1.1.1
Overview
DNS Wireformat
Using JSON
Configure DoH on your browser
Connect to 1.1.1.1 using DoH clients
Oblivious DoH
DNSKEY
Upstream resolution
Infrastructure
Network operators
Support for IPv6-only networks
Extended DNS error codes
SLA and support
Other ways to use 1.1.1.1
DNS in Google Sheets
DNS over Discord
DNS over Tor
Privacy
Overview
1.1.1.1 Public DNS Resolver
Cloudflare Resolver for Firefox
Verify connection
Troubleshooting
Terms of use
FAQ
Changelog
Agent resources
Agent setup ↗
Cloudflare Skills ↗
Code Mode MCP Server ↗
Domain-specific MCP Servers ↗
MCP
1.1.1.1 llms.txt ↗
1.1.1.1 llms-full.txt ↗
Cloudflare Docs llms.txt ↗
Cloudflare Docs llms-full.txt ↗
Home
/
1.1.1.1 (DNS Resolver)
/
Upstream resolution
Upstream resolution
Last updated
Apr 30, 2026
|
Copy as Markdown
|
View as Markdown
|
Agent setup
Overview
Query name minimization
Root zone
Nameserver selection
Retry behavior
Response selection
When 1.1.1.1 does not have an answer in its cache, it contacts authoritative nameservers on your behalf. Authoritative nameservers are the DNS servers that hold the actual records for a domain. This page describes how 1.1.1.1 selects which nameserver to query, what happens when a nameserver is unreachable, and how the final response is determined.
Query name minimization
When resolving a multi-level domain name like
foo.bar.example.com
, 1.1.1.1 does not reveal the full name to every server in the chain. Instead, it sends only the minimum information each server needs. For example, when asking the
.com
TLD server, 1.1.1.1 only discloses that it needs to find
example.com
— the subdomain parts (
foo.bar
) are not included. This limits the amount of information exposed to intermediary servers and reduces privacy leakage.
Root zone
1.1.1.1 uses
locally hosted copies of the root zone file
↗
instead of querying remote root servers for every lookup. The root zone file contains the addresses of all top-level domain (TLD) servers. By hosting it locally, 1.1.1.1 avoids a network round trip to root servers, which reduces latency, improves privacy, and decreases load on the global DNS root server system.
Nameserver selection
Most domains have multiple authoritative nameservers for redundancy. When 1.1.1.1 needs to query one, it chooses based on measured performance. The resolver tracks metrics for each nameserver — including round-trip time (how long a query takes to travel to the server and back) and response quality — then picks the nameserver that has historically been fastest and most reliable from the data center handling your request.
If the selected nameserver does not respond in time or returns an error, 1.1.1.1 retries against a different nameserver for the same zone. Refer to
Retry behavior
for details.
A small percentage of queries are also sent to alternative nameservers so that performance measurements stay current. This allows a previously slow server to be re-evaluated if its performance improves. For more background on the system that powers this selection, refer to the
BigPineapple architecture blog post
↗
.
Retry behavior
If a nameserver does not respond in time or returns a temporary error, 1.1.1.1 retries the query against a different authoritative nameserver for the same zone. The unresponsive server is deprioritized so that subsequent queries prefer healthier alternatives. 1.1.1.1 periodically re-checks deprioritized servers to detect recovery.
When multiple clients request the same domain at the same time, 1.1.1.1 deduplicates the upstream queries so that a single in-flight request serves all waiting clients. The exact retry timing and ranking logic are tuned over time and may change.
Response selection
For a given query, 1.1.1.1 returns only one answer to the client. When authoritative nameservers disagree, which response 1.1.1.1 selects depends on the type of responses received.
The following DNS response codes are relevant:
NOERROR
— The query succeeded. The response contains the requested records, or indicates that the name exists but has no records of the requested type (sometimes called
NODATA
).
NXDOMAIN
— The domain name does not exist.
SERVFAIL
— The nameserver encountered an internal error and could not answer.
REFUSED
— The nameserver refused to answer the query.
How 1.1.1.1 handles disagreements between nameservers:
NOERROR
versus
NXDOMAIN
:
Both are valid authoritative answers. 1.1.1.1 returns whichever response it receives first and does not query remaining nameservers to compare. Authoritative nameservers for the same zone are expected to be consistent. If one returns
NXDOMAIN
and another returns
NOERROR
for the same name, that indicates a misconfiguration on the authoritative side.
Timeout versus a valid response:
A timeout is not an answer. 1.1.1.1 retries against another nameserver and returns the first valid response it receives.
SERVFAIL
or
REFUSED
versus a valid response:
Temporary failures are treated as upstream errors, not authoritative answers. 1.1.1.1 retries against another nameserver and returns the first valid response. Only if all nameservers return errors does 1.1.1.1 return a failure to the client — typically
SERVFAIL
, or
REFUSED
if that is what the nameservers consistently returned.
Previous
DNSKEY
Next
Network operators
Was this helpful?
Yes
No
Edit page
Report issue
On this page
Overview
Query name minimization
Root zone
Nameserver selection
Retry behavior
Response selection
Edit page
Report issue
Getting started
Plans
Contact sales
Partners
Find a partner
Startups
Under attack?
Domain name search
Company
About
Careers
Investors
Press
Press kit
Global network
Public interest
Project Galileo
Athenian Project
Cloudflare for Campaigns
Project Fairshot
Impact/ESG
Compliance
Compliance resources
Trust Hub
Data Protection
Responsible AI
Transparency report
Report abuse
Resources
App innovation report
Cloudflare Radar
Case studies
Status
Support
Events
Blog
Developers
Documentation
Learning center
Community
Solutions
SSE and SASE platform
Cloudflare AI Cloud
AI Security
Frontend Development Platform
Multi-Tenant Platform Development
Web Security Platform
Start Building
Log In
© 2026 Cloudflare, Inc.
Privacy policy
|
Report security issues
|
Terms of use
|
Trademark
|
Your privacy choices
Docs
