Cloudflare Makes Internal DNS Generally Available for Private Networks

Cloudflare has announced that its Internal DNS feature is now generally available, moving out of beta and into production for all eligible accounts as of July 20, 2026. The Domain Name System (DNS) is the internet's phonebook, translating human-friendly names like example.com into the numerical IP addresses that devices use to find each other. Internal DNS does the same job for private resources, such as an employee portal or a database, that should only be visible inside a company network. With this release, businesses can bring their private DNS zones into Cloudflare's global platform and let their teams resolve those internal hostnames through Cloudflare's Gateway resolver, a service that handles DNS queries under policy control. The announcement, authored by Cloudflare product leaders Enrique Somoza and Hannes Gerhart, positions the feature as part of the company's broader Connectivity Cloud rather than a standalone tool.

Setting up the feature follows a clear sequence. First, an administrator creates a DNS view, which is a named collection of DNS zones, and links one or more zones to that view through the Cloudflare API. A DNS zone is like a folder that holds all the DNS records for a particular domain or subdomain. The API call shown in Cloudflare's documentation uses an account ID and a zone ID to create a view named production-view, then attaches a specific zone to it. Next, the team builds a Gateway resolver policy in the Zero Trust dashboard. Zero Trust is a security approach that requires every access request to be verified, even inside the network. The policy sets conditions, such as which users or devices match, and selects Internal DNS View as the resolution method. Once saved, any DNS query that matches the policy is answered from the internal zones, while other queries continue as normal. Administrators can also manage this entire setup with Terraform, a popular tool for infrastructure-as-code that lets teams define resources in configuration files instead of clicking through dashboards. Because Terraform writes through the same DNS Records API as everything else, changes made in Terraform follow the identical ingestion and propagation path, reducing surprises and making rollbacks possible. Full documentation and end-to-end configuration examples are available in Cloudflare's developer documentation.

Internal DNS works with any Cloudflare connectivity method that routes DNS traffic through the Gateway Resolver. That includes the Cloudflare One Client (formerly known as WARP), which is a software agent that routes device traffic securely; DNS over HTTPS (DoH) and DNS over TLS (DoT), two standards that encrypt DNS queries so they cannot be read or altered in transit; standard DNS on port 53, which is the traditional unencrypted method; PAC file deployments, which use proxy auto-configuration scripts; and Cloudflare WAN, a service that connects an organization's offices and data centers into a private network. For organizations running Cloudflare WAN, every device on that connected network can resolve internal hostnames through Cloudflare without needing the Cloudflare One Client installed on each individual device. The result is a consistent DNS experience across remote users, branch offices, data centers, and cloud environments, all managed from a single control plane. This matters because many businesses run separate DNS servers for different locations, leading to inconsistent answers and harder troubleshooting.

Cloudflare is careful to emphasize that Internal DNS is not a standalone DNS service. It extends the same Connectivity Cloud platform that organizations already use to secure users with Zero Trust policies, connect networks with Cloudflare WAN, accelerate applications, and protect internet-facing services. By bringing private DNS onto the same global network as everything else, Cloudflare sets the stage for deeper integration. The company states that tighter integration across DNS, networking, and Zero Trust policy is the next step, so that resolving an internal hostname, reaching the service behind it, and enforcing who is allowed to access it become decisions made through a single platform, rather than multiple disconnected systems. For IT teams, this consolidation can reduce operational overhead and close security gaps that arise when different tools have conflicting policies.

From a privacy and security standpoint, the move reflects a broader industry shift toward encrypting DNS traffic and centralizing policy. Even for organizations that do not use Cloudflare, the principles apply: separating internal and public DNS zones, encrypting queries where possible, and using access controls are baseline defenses against DNS hijacking and data leakage. For readers who want a private, encrypted DNS resolver outside a single vendor's ecosystem, AEU DNS (https://aeu-dns.com) offers a no-logs, privacy-first service that encrypts DNS queries over HTTPS, TLS, and QUIC, helping individuals and businesses keep their lookups private from network snoops. Cloudflare encourages operators to open the dashboard, navigate to Networking, then Internal DNS, and create a first zone, and to join the Cloudflare Community for questions and comparisons. The announcement is a reminder that DNS, often overlooked, is critical infrastructure that deserves the same security attention as any application.