What Is 1.1.1.1? The Complete Guide to Setting Up Cloudflare's Free DNS
In a hurry? Change your device's DNS server to 1.1.1.1 with 1.0.0.1 as the backup. That's it. It's free, there's no account to create, and nothing to install. Step-by-step instructions for each device are below, along with how to check that it actually worked.
What Is DNS?
Your phone's contact list stores "Mum," not an eleven-digit number. You tap the name, and the phone looks up the number for you.
DNS is the contact list for the entire internet. When you type google.com, your computer has no idea what that means. It first has to ask a machine called a DNS server: "what is the address for google.com?" Only once it gets back a string of numbers — an IP address — can it actually connect.
This happens every time you open a page or refresh an app, thousands of times a day. You have never noticed it, because it usually just works.
Why This Is Worth Your Attention
There are two problems with the default arrangement.
Whose contact list are you using? Your broadband or mobile provider's. You never chose it; it was assigned automatically. Their server may be slow, may be poorly maintained, and may be doing other things besides answering your questions.
Your lookups are sent in plain text. When you ask "where is example.com," that question travels unencrypted. Other people on the same Wi-Fi, whoever runs that Wi-Fi, and your network provider can all, in principle, see which sites you have looked up.
At home this may not worry you. On free Wi-Fi in a café, an airport or a hotel it should — you have no idea who is running that network.
Switching to a better DNS is the cheapest possible fix for both problems: no money, no software, five minutes.
What Is 1.1.1.1?
1.1.1.1 is a free public DNS service from Cloudflare, launched on 1 April 2018 and operated in partnership with APNIC, the Asia Pacific Network Information Centre.
Cloudflare is an American internet infrastructure company; a substantial share of the world's websites run through its services. This DNS resolver is open to everyone at no cost, with no account and no download. You are simply changing the "contact list address" in your device from your provider's to theirs.
The memorable number 1.1.1.1 is an address held by APNIC, which the two organisations agreed to use for this purpose.
What It Actually Gives You
Speed
Cloudflare runs servers in hundreds of cities worldwide using a technique called anycast. In plain terms, your lookup is automatically routed to the nearest available server rather than travelling somewhere distant.
What you will notice: pages start loading a little sooner. The improvement is usually measured in tens of milliseconds. It will not make your broadband faster, but the web will feel more responsive.
Privacy
Cloudflare makes several specific commitments for this service: it does not sell your browsing data, does not write querying IP addresses to disk, and purges query logs within 24 hours.
More importantly, it has engaged one of the big four accounting firms to audit those practices independently and publish the report. Anyone can write a promise. Paying an outside firm to check it and publishing the result is a different level of commitment.
It also supports two forms of encryption, DoH (DNS over HTTPS) and DoT (DNS over TLS). With either enabled, the plain-text problem described above goes away — people in between can no longer see what you are looking up.
Blocking Malicious Sites
If you use the 1.1.1.2 address (explained in the next section), known malware and phishing domains are blocked automatically. Someone sends you a link to a convincing fake banking login page; you tap it; the connection is stopped before it is ever made.
This is not a replacement for antivirus software. It is a free extra door, placed early in the chain.
Three Addresses — Which One?
Cloudflare offers three sets of addresses with different behaviour:
| Address | What it blocks | Who it suits |
|---|---|---|
| 1.1.1.1 / 1.0.0.1 | Nothing | You want maximum speed and will judge risk yourself |
| 1.1.1.2 / 1.0.0.2 | Malware and phishing | Recommended for most people |
| 1.1.1.3 / 1.0.0.3 | Malware, phishing and adult content | Households with children |
Speed and privacy policy are identical across all three. The only difference is what gets filtered.
A note for parents: setting 1.1.1.3 on your home router covers every device in the house — tablets, TV boxes, consoles — without installing control software on each one. But it filters at the domain level and it is not absolute: if a child switches from home Wi-Fi to mobile data, the setting no longer applies.
If you are unsure, use 1.1.1.2.
How to Set It Up
Every method below is equally straightforward. Find the device you are using. You are entering two addresses: a primary and a backup.
[Screenshot slot] Two real screenshots per platform is worth the effort. Non-technical readers complete image-led instructions far more often than text-only ones.
Windows 11
- Open Settings → Network & internet
- Click the connection you are using (Wi-Fi or Ethernet)
- Click Hardware properties
- Find DNS server assignment and click Edit
- Change Automatic (DHCP) to Manual
- Turn on the IPv4 toggle
- Preferred DNS:
1.1.1.1— Alternate DNS:1.0.0.1 - Set Preferred DNS encryption to Encrypted only (DNS over HTTPS)
- Click Save
Step 8 exists only on Windows 11 and switches on encrypted lookups. It is worth selecting.
macOS
- Open System Settings → Network
- Select your active network and click Details
- Go to the DNS tab
- Click + at the bottom left and enter
1.1.1.1 - Click + again and enter
1.0.0.1 - Select any of your provider's original addresses above and click − to remove them
- Click OK, then Apply
iPhone / iPad
- Open Settings → Wi-Fi
- Tap the ⓘ next to the network you are connected to
- Scroll down and tap Configure DNS
- Change Automatic to Manual
- Remove the existing servers, tap Add Server, enter
1.1.1.1 - Add a second server:
1.0.0.1 - Tap Save
Note: on iPhone this setting is saved per Wi-Fi network. You will need to repeat it on each network you join, and it does not apply to mobile data.
Android
Android has a better option that works everywhere and includes encryption by default:
- Open Settings → Network & internet
- Find Private DNS (on some phones it sits under "More connection settings")
- Choose Private DNS provider hostname
- Enter
one.one.one.one - Save
This uses DoT encryption and applies on both Wi-Fi and mobile data, which makes it better than entering IP addresses.
For the filtered versions, use security.cloudflare-dns.com (malware blocking) or family.cloudflare-dns.com (malware and adult content) as the hostname instead.
Router (Recommended)
Change it once on your router and every device in the house — computers, phones, TVs, smart speakers — is covered automatically.
The exact path differs by brand, but broadly:
- Open your router's admin page in a browser (commonly
192.168.1.1or192.168.0.1) - Log in (the password is usually on a sticker on the router itself)
- Find DNS settings, often under "WAN settings," "Internet settings" or "LAN settings"
- Enter
1.1.1.1and1.0.0.1 - Save and restart the router
[Screenshot slot] Router interfaces vary enormously. Cover the two or three brands your readers are most likely to own.
How to Check That It Worked
Most guides skip this step, and it is the most important one — otherwise you have no idea whether anything changed.
Open this in your browser: https://1.1.1.1/help
You will see a diagnostic page. What to look for:
- Connected to 1.1.1.1 — if this says Yes, you are set
- Using DNS over HTTPS (DoH) or Using DNS over TLS (DoT) — a Yes on either means encryption is active
If the first line says No, the usual causes are: the network was not restarted after the change, a router setting is overriding your device, or a workplace or school network is forcing its own DNS.
What It Does Not Protect You From
Please read this section. Plenty of articles online imply that changing your DNS makes you anonymous. It does not.
It is not a VPN. Your IP address is still visible to every site you visit. They still know roughly which city you are in and which provider you use.
It does not hide where you go. Encrypted DNS conceals the "which domain did you look up" layer, but your traffic still has to reach that site's IP address, and your network provider can still infer your destination from that IP and from a field called SNI.
It does not encrypt page content. The passwords you type and the messages you send are protected by the padlock — HTTPS — not by DNS.
It does not stop viruses, or stop you being fooled. 1.1.1.2 blocks known malicious domains. It cannot block brand-new ones, and it certainly cannot stop you typing your password into a convincing fake page.
Think of it as brushing your teeth: basic, effective, everyone should do it — and no substitute for seeing a dentist.
Troubleshooting
Find your symptom:
My work computer can no longer reach internal systems Company networks usually run their own internal domain names that only the company's DNS knows about. Set it back to Automatic (DHCP), or leave DNS alone while on the work network. The same applies when connected through a corporate VPN.
The hotel or airport Wi-Fi login page will not appear That "click to accept" page depends on the network operator's own DNS. Switch back to automatic, connect and log in, then change it back to 1.1.1.1.
Video streaming or downloads got slower Possible. For privacy reasons, Cloudflare does not by default pass your approximate location to the site you are visiting (technically, EDNS Client Subnet). A few streaming and download services may as a result route you to a more distant server. If you notice a real difference, compare against another resolver and use whichever performs better for you.
A perfectly normal site stopped loading If you are on 1.1.1.2 or 1.1.1.3, it may have been caught by the filter. Switch to 1.1.1.1 and try again. If that fixes it, the filtering rules were the cause.
I want to undo all of this Follow the same steps and set it back to Automatic or DHCP. The change is completely reversible and cannot break anything permanently.
How It Compares to Other Free Resolvers
| Cloudflare 1.1.1.1 | Google 8.8.8.8 | Quad9 9.9.9.9 | |
|---|---|---|---|
| Speed | Very fast | Very fast | Slightly slower |
| Privacy | Logs purged in 24h, third-party audited | Longer data retention | Swiss non-profit, strict policy |
| Blocks malicious sites by default | No (use 1.1.1.2) | No | Yes |
| Passes location for CDN routing | No, by default | Yes — more precise routing | No |
| Operated by | Infrastructure company | Advertising company | Non-profit foundation |
The short version: for a balance of speed and privacy, use 1.1.1.2; if you prefer a non-profit, use Quad9; if streaming and download routing matters most, Google's may perform better. All three are free, and you can switch at any time.
Frequently Asked Questions
Does it cost anything? No. The service is entirely free and there is no paid DNS tier. Cloudflare sells a separate product called WARP, which is a different thing and is not required.
Will it make my internet faster? No. Your bandwidth is set by your plan and DNS cannot change it. What improves is the short wait before a page begins to load.
Can Cloudflare see which sites I visit? Your lookups do pass through them. Their commitments are not to sell that data, not to log querying IP addresses, to purge logs within 24 hours, and to submit to third-party audit. So you are moving that trust from your provider to Cloudflare rather than eliminating it.
Can I change back? At any time. Set it to Automatic and everything returns to normal.
Does it work on mobile data? Not on iPhone — the setting applies only to Wi-Fi. On Android it does, if you set it up through Private DNS.
Is 1.1.1.1 the same as the 1.1.1.1 app? No. The app includes WARP, a traffic proxy, which is different from simply changing your DNS. You do not need the app to use the resolver.
How do I manage my children's devices? Set 1.1.1.3 on your home router and adult content is filtered for every device in the house. It has no effect once a child switches to mobile data.
Finally
Changing your DNS is one of the best returns on effort in personal security: five minutes, no cost, reversible at any time, in exchange for faster lookups, a stronger privacy commitment and a free layer of protection against malicious sites.
Just keep its limits in mind. It is basic hygiene, not an invisibility cloak. What actually protects your accounts remains the unglamorous stuff: a different password for every site, two-factor authentication turned on, and not clicking links from strangers.