Set up
By default, your devices use a DNS server ↗ provided by your Internet service provider (ISP). You can change this to use 1.1.1.1 instead, which gives you faster and more private DNS resolution. Some ISPs and network equipment providers already partner with Cloudflare to offer this.
If your provider does not use Cloudflare, follow the instructions for your device or router below.
Device or router specific guides
You can also set up 1.1.1.1 for Families for additional protection against malware and adult content on your home network. 1.1.1.1 for Families uses the same privacy commitments as the standard 1.1.1.1 resolver.
1.1.1.1 for Families automatically blocks DNS queries to domains associated with malware, phishing, or (optionally) adult content.
1.1.1.1 for Families has two options:
Block malware
Use the following DNS resolvers to block malicious content:
1.1.1.21.0.0.22606:4700:4700::11122606:4700:4700::1002
Block malware and adult content
Use the following DNS resolvers to block malware and adult content:
1.1.1.31.0.0.32606:4700:4700::11132606:4700:4700::1003
When a queried domain is classified as malicious, Cloudflare returns the address 0.0.0.0 instead of the real address. This prevents your device from connecting to the blocked site.
After configuring 1.1.1.1 for Families, verify that filtering is working with the following test URLs:
- https://malware.testcategory.com/ ↗ — Tests whether known malware domains are blocked.
- https://nudity.testcategory.com/ ↗ — Tests whether adult content and malware domains are blocked.
DNS over HTTPS (DoH) encrypts your DNS queries by sending them as HTTPS requests. This prevents anyone between your device and the resolver — such as your ISP or a network attacker — from seeing which domains you look up. For more information, refer to the Learning Center article on DNS encryption ↗.
To configure an encrypted DoH connection to 1.1.1.1 for Families, enter one of the following URLs in your DoH-compatible client or router:
Block malware
https://security.cloudflare-dns.com/dns-queryBlock malware and adult content
https://family.cloudflare-dns.com/dns-queryDNS over TLS (DoT) encrypts DNS queries using TLS on a dedicated port (853). Like DoH, it prevents eavesdropping on your DNS traffic. For more information, refer to the Learning Center article on DNS encryption ↗.
To configure an encrypted DoT connection to 1.1.1.1 for Families, enter one of the following hostnames in your DoT-compatible client or router:
Block malware
security.cloudflare-dns.comBlock malware and adult content
family.cloudflare-dns.com