1.1.1.1 Resolver Passes Independent Privacy Examination
Cloudflare has completed an independent examination of the privacy commitments attached to its 1.1.1.1 public DNS resolver. The examination, conducted by a Big 4 accounting firm, covered the period from February 1, 2019, through October 31, 2019. The independent accountants' report is now available on Cloudflare's compliance page.
The core finding: the resolver's systems are configured so that querying IP addresses and DNS queries are never written to disk together. Cloudflare cannot identify who makes a specific request, does not track which sites individual users visit, and does not sell personal data.
How the Examination Worked
The examination itself was something of a first. Getting an accounting firm to agree on terms and complete what Cloudflare believes is the first examination of custom privacy commitments for a recursive resolver took considerably longer than a standard audit. The firm aligned the resolver examination with Cloudflare's SOC 2 report, which provided the change control procedures and audit logs needed to confirm that IP truncation logic and data retention limits were active throughout the examination window.
Cloudflare points to its privacy-by-design approach as the reason the examination was passable at all. In line with RFC 6235, the resolver truncates client/source IP addresses at the edge data centers, so full IP addresses never reach non-volatile storage. For internal logs, Cloudflare goes further, replacing truncated IPs with the network number (ASN) and retaining those anonymized logs only briefly.
From Commitments to Not-So-Clear Statements
The examination did surface two areas Cloudflare now addresses publicly.
First, Cloudflare acknowledged that its routers randomly capture a sample of requests—up to 0.05% of all traffic passing through its network—including querying IP addresses. This sampling happens separately from the 1.1.1.1 service and applies to all traffic, not just DNS queries. The data is held for a limited period and used for network troubleshooting and mitigating denial-of-service attacks. High-frequency source IPs are often associated with malicious requests or botnets, and Cloudflare says it needs this information to defend its network and prevent it from being used as an attack vector. The sampled data is not linked to DNS queries handled by the resolver.
Second, Cloudflare conceded that its earlier promises about handling anonymous logs were confusing. The original blog post announcing the resolver did not clearly distinguish between temporary, transactional, and permanent logs. For example, the resolver's privacy FAQs said transactional logs would not be kept beyond 24 hours while some anonymous logs would be retained indefinitely—a distinction the launch blog post failed to capture. Cloudflare has since updated its privacy commitments page with clearer language.
What Cloudflare Now Commits To
Cloudflare refined its stated commitments as part of the examination effort. The intent remains the same as the original promises, but the wording is now more precise. The examined commitments are:
- Cloudflare will not sell or share public resolver users' personal data with third parties, nor use such data to target users with advertisements.
- Cloudflare will retain only what is asked, not information identifying who asked it. Except for the randomly sampled network packets captured from at most 0.05% of traffic, Cloudflare will not retain the source IP from DNS queries in non-volatile storage. Random samples are used solely for network troubleshooting and DoS mitigation.
- Source IP addresses will not be stored in non-volatile storage. Cloudflare anonymizes them via IP truncation—last octet for IPv4, last 80 bits for IPv6—and deletes the truncated addresses within 25 hours.
- Cloudflare retains only limited transaction and debug log data ("Public Resolver Logs") for legitimate resolver operation and research, deleting these logs within 25 hours.
- Public Resolver Logs will not be shared with third parties except APNIC under a Research Cooperative Agreement. APNIC gets limited query access to anonymized data for DNS system research.
Why the Audit Matters
The 1.1.1.1 resolver was built in response to a straightforward privacy problem: ISPs, Wi-Fi networks, mobile carriers, and other eavesdroppers can observe every site a user visits and every app they use, even when content is encrypted. Some DNS providers monetize that activity. DNS is also a censorship tool, which matters for groups Cloudflare protects through Project Galileo.
For users who connect via DNS-over-HTTPS or DNS-over-TLS, queries travel over a secure channel, adding protection against eavesdroppers on top of Cloudflare's privacy guarantees. Cloudflare encourages other DNS providers to submit their privacy commitments to similar independent examinations and points to Mozilla's work encouraging recursive resolver operators to adopt user-protective data handling practices.
