DNS
Cloudflare runs one of the world's fastest and most resilient authoritative DNS services — the address book that turns your domain names into IPs — answering queries from 300+ cities with median latency around ten milliseconds.
Overview
DNS is the first step of every visit to your site and every email sent to your domain: before anything else happens, a resolver must ask your authoritative DNS servers where to go. Slow DNS adds latency to everything; failed DNS takes you off the internet entirely, no matter how healthy your servers are.
Cloudflare's authoritative DNS answers from every one of its 300+ locations via anycast, which makes it both extremely fast and extremely hard to knock over — the same DDoS protection that shields websites shields the DNS infrastructure itself. Records propagate globally within seconds of an edit, not the hours legacy providers quote.
Key capabilities
- Anycast authoritative DNS served from 300+ cities, with consistently top-ranked global response times (~10 ms median)
- Near-instant propagation — record changes are live worldwide within seconds
- One-click DNSSEC with automatic key management, protecting users from forged DNS answers
- Full record-type support, plus CNAME flattening so apex domains can point at other hostnames
- Built-in DDoS protection for the DNS layer itself — attacks on your nameservers are absorbed by the network
- Secondary DNS and multi-provider setups with automatic zone transfers (Enterprise)
- Full API and Terraform support, DNS analytics, and audit logs of every change
- Proxied records integrate DNS directly with Cloudflare's CDN and security stack
How it works
With anycast, all of Cloudflare's nameservers share the same IP addresses, announced simultaneously from every data centre. A resolver in Prague gets its answer from Prague; one in Singapore from Singapore. This collapses response times and means an attack or outage in one region simply reroutes queries elsewhere — there is no single point whose failure silences your domain.
Records you create in the dashboard or API are compiled and pushed to the entire edge within seconds. Each record can be DNS-only (Cloudflare answers with your server's actual IP) or proxied (Cloudflare answers with its own edge IPs, pulling that hostname's traffic through the CDN, WAF and DDoS stack). This toggle is how the rest of the Cloudflare platform attaches to your domain.
DNSSEC, enabled with one click, cryptographically signs your zone so resolvers can verify answers haven't been forged in transit — closing off cache-poisoning attacks that can silently redirect your users.
Plans & licensing
Authoritative DNS, DNSSEC, CNAME flattening and the API are included on all plans, including Free. Enterprise adds secondary/multi-provider DNS, DNS firewall options, account-level features and contractual SLAs. Load balancing with health checks is a separate add-on available to any plan. As of 2026, subject to change — confirm current packaging with us.
Deployment with Integrity
As a certified Cloudflare partner for Central and Eastern Europe, Integrity delivers this product end to end — including a free pilot so you see results on your own traffic before committing. A typical rollout:
- Assessment. We audit your current zones — every record, TTL, mail configuration (MX/SPF/DKIM/DMARC) and hidden dependency — before anything moves.
- Free pilot. A copy of your zone is imported into Cloudflare and verified record-by-record against production answers.
- Cutover plan. TTLs are lowered in advance and a rollback path is documented; email and third-party validations get special attention.
- Migration. Nameservers are switched at the registrar during an agreed window; we monitor query patterns and answer correctness on both old and new during the transition.
- Hardening. DNSSEC is enabled, change auditing and alerting configured, API/Terraform access set up for your team.
- Handover or managed DNS. Your team operates it with our documentation, or Integrity manages the zones ongoing — contact us to start with the free pilot.
Ready to start? Contact us to arrange the free pilot.
FAQ
Will migrating DNS cause downtime?
Done properly, no. The zone is fully replicated and verified before nameservers change, and old nameservers keep answering during propagation. Users experience no interruption; the switch is invisible when the records match.
Do we have to use Cloudflare's CDN and security if we move DNS?
No. Every record can be set to DNS-only, in which case Cloudflare is purely your authoritative DNS. You can enable proxying per-hostname later, whenever you choose.
Will our email keep working?
Yes — MX, SPF, DKIM and DMARC records migrate like any other record and are part of our pre-cutover verification. Mail-related records are never proxied, so mail flow is untouched.