Cloudflare Radar gets a dedicated DNS view

Cloudflare has launched a dedicated DNS page on Radar, aggregating data from its 1.1.1.1 public resolver. The resolver, launched on April 1, 2018, now handles an average of 1.9 trillion queries per day from roughly 250 locations. The new page aims to surface trends in DNS traffic, protocol usage, query characteristics, and security posture, complementing existing Radar features like Domain Rankings and the AS112 statistics page.

The data reflects anonymised DNS query logs from 1.1.1.1, per Cloudflare's privacy policy and public resolver privacy commitments. Traffic analyzed can originate from users who manually configure their devices, from ISPs that set 1.1.1.1 as the default resolver for subscribers, from ISPs that use it as an upstream resolver, or from users running the 1.1.1.1/WARP app.

The page opens with normalized query volume, which can be viewed worldwide, or filtered by a specific location or autonomous system (ASN). Like other Radar traffic charts, the time period is adjustable, and default ranges like the last 24 hours or seven days include comparisons against the previous equivalent period.

For location-level views, a table shows the top five ASNs by query volume from that country or region. A separate chart plots query volumes for the country's associated country code top-level domain (ccTLD) on a worldwide basis versus the country's own queries. For example, Anguilla's .ai ccTLD is heavily used by AI companies, but the small local user base produces a much lower "local" query line compared to worldwide volumes. Similar gaps appear for other popular ccTLDs like .io, .fm, and .co.

Beyond general trends, the data can corroborate network-level events. The page documentation cites a drop in queries from Venezuelan providers CANTV and Supercable in late January and early February 2025, following reports that both had blocked access to 1.1.1.1 for their subscribers.

At the bottom of the worldwide overview, a choropleth map shows the geographic distribution of resolver traffic based on each location's share of global queries.

Query and response characteristics

The DNS page breaks down the transport protocols used for queries. RFC 1035 originally specified UDP and TCP on port 53, but encrypted options have since been added: DNS over TLS (DoT) in 2016 and DNS over HTTPS (DoH) in 2018. Cloudflare's resolver has supported both since its launch.

Worldwide aggregated data from February 19-26 shows 86.6% of queries over UDP, 9.6% over DoT, 2.0% over TCP, and 1.7% over DoH. However, these ratios vary by location—Egypt, for example, shows lower UDP and TCP shares and higher DoT and DoH shares, suggesting greater privacy awareness among users there. Note that traffic from Mozilla and other large platforms that use DoH or Oblivious DoH is not included in the analysis, so DoH adoption is under-represented.

The query type graph shows that A and AAAA record lookups together account for roughly 80% of queries. Among other types tracked are HTTPS records, which can signal HTTP/3 and HTTP/2 support; PTR records for reverse DNS lookups; and NS records that indicate authoritative nameservers.

Response codes are also charted. NOERROR represents the clear majority of responses, including empty responses where no records exist for the query name and type but records exist for other types. When errors do occur, NXDOMAIN (no such record) is the most common. Codes may originate from the resolver itself, as with REFUSED, or from upstream authoritative nameservers.

Adoption, cache performance, and TTLs

Two graphs address adoption of underlying protocols. The "record adoption" view shows what fraction of queries for a given record type receive useful answers. Globally, A record queries succeed about 88% of the time, while IPv6 is more commonly absent. The traffic shaper shows that more than 80% of responses served globally come from cache.

A separate chart examines time-to-live (TTL) values for popular record types. The resolver caches responses based on the smallest TTL among included records. When the cache expires, it must consult the authoritative nameserver again. During the third week of February, over 80% of A and AAAA records carried TTLs below five minutes, while NS and MX records skewed to longer durations between 15 minutes and one day, given that those records change infrequently.

DNSSEC metrics

Several charts focus on DNSSEC. The client awareness graph shows the share of resolvers that set the "DO" bit, signaling readiness to accept DNSSEC data. Validation posture is also tracked: roughly 70% of queries to the resolver originate from clients that don't understand DNSSEC, so responses are being validated by the resolver by default for those clients.

The validation status graph shows the share of queries for domains that are signed (Secure or Invalid) versus unsigned (Insecure). Though 93% of generic TLDs and 65% of ccTLDs are signed, adoption at the individual domain level lags: over 80% of queries hit domains without DNSSEC enabled. The end-to-end security view combines client DNSSEC capability with encryption usage (DoT or DoH) to show the fraction of interactions protected from tampering end-to-end.

Data access and exploration

All data listed on the DNS page is available through the Radar API and interactive Data Explorer for custom breakdowns by location, network, and time frame. Charts are downloadable and embeddable for sharing. Users can also reach out to Cloudflare on social media or via email for questions or comments.