Cloudflare has announced the general availability of its Internal DNS service, a cloud-native authoritative and recursive DNS for private networks. The announcement has come after a period of private and public beta testing that started in June 2025.
According to the company, the new capability will simplify how IT teams and companies operate and manage private DNS workloads. It promises to consolidate both private and public DNSs onto a single control plane, with a unified API, audit trail, and policy registry.
In the announcement, Enrique Somoza, product manager at Cloudflare, and Hannes Gerhart, senior product manager at Cloudflare, explain how the service is designed.
Cloudflare Internal DNS consists of two components: Gateway Resolver and Internal Authoritative DNS. Authoritatively managing zones is a different job from enforcing DNS security and routing policies.
The authors explain that the two components are built on the same platform Cloudflare has been operating for the last decade, capitalising on the experience gained from managing it at scale.
Users can operate on three different entities: internal zones, DNS views, and resolver policies. Internal zones contain the authoritative records for private resources, such as applications, service endpoints, or databases. DNS views allow the composition of different internal zones for specific use cases, reducing configuration duplication and drift, and making split-horizon setups work without parallel systems. Finally, resolver policies, which are stored in the gateway resolver component, match incoming requests and forward them to a specific DNS view.
A new DNS request is initially evaluated by the gateway resolver component against the registered policies. These policies can either block or forward it. If a policy matches and points to a DNS view, the request is forwarded to the internal authoritative DNS for resolution. Otherwise, it is routed to the public path. Additionally, DNS views can also be configured to fall back to public resolution if the requested name cannot be found internally, simplifying client name retrieval.
The company states that changes to the DNS configuration follow a predictable path from input to edge, regardless of where they originate. Whether from the management dashboard, a Terraform module, or a direct API call, all operations pass through the same unified ingress, promising simpler audits.
On Reddit, tankerkiller125real argues that the announcement breaks Cloudflare’s promise of not launching enterprise-only features.
Whatever happened to "No more enterprise only features"... Seems that plan has been tossed out the window.
In the same thread, ninadpathak highlights the enterprise nature of the feature.
[...] this is a pretty niche product, and the use cases aren't immediately clear unless you're dealing with a large internal network.
Developers and IT teams running their workloads on other cloud providers can manage their private and public DNS registries using provider-specific services and capabilities. On AWS, developers can use Route 53 Resolver and Route 53 private hosted zones. Similarly, on Azure, Private DNS and DNS Private Resolver are available. Finally, on Google Cloud, teams can find private, forwarding, and peering zones in Cloud DNS.
Cloudflare Internal DNS is available to all enterprise-level customers without any additional charge and can be managed via the management console, Terraform, or Cloudflare API.
0 Comments
Log in to join the conversation.No comments yet. Be the first to share your thoughts.