跳转到主要内容

Resolver endpoints

import { GlossaryDefinition, Render } from "~/components";

  1. Change the DNS resolvers on your router, browser, or OS by following the setup instructions in the UI.
  2. Select Go to DNS Location. Your location will appear in your list of locations.

You can now apply DNS policies to your location using the Location selector.

DNS endpoints

IPv4 and IPv6 DNS

Cloudflare will prefill the Source IPv4 Address based on the network you are on. Additionally, Enterprise users can use dedicated DNS resolver IP addresses assigned to their account or resolver IP addresses they provide (BYOIP).

You do not need to configure the IPv4 DNS endpoint if:

:::note[Your IPv4 address is taken error] When you try to configure a DNS location over IPv4, Gateway may display a Your source IPv4 address is taken error. This may mean someone else in the same network configured Gateway before you did. If your network supports IPv6, you can still use Gateway's DNS filtering by sending DNS queries over IPv6. You can also use the DNS over HTTPS hostname to send queries using a DNS over HTTPS client.

If you think someone else is wrongfully using this IPv4 address, contact Cloudflare support. :::

DNS over TLS (DoT)

For more information, refer to DNS over TLS.

DNS over HTTPS (DoH)

Gateway requires a DoH endpoint for default DNS locations. For more information, refer to DNS over HTTPS.

DNS64

Gateway can synthesize AAAA records from A records for IPv6-only networks. These networks require network address translation from IPv6 to IPv4 (NAT64).

Turn on Enable DNS64 for a location, or request synthesis for an individual query.

For configuration and request examples, refer to DNS64.

Secure DNS locations

Secure DNS locations provide additional protection against malicious domains for use in services such as protective DNS (PDNS). For a DNS location to be considered secure, Gateway requires that:

  • Your IPv4 and IPv6 endpoints use your BYOIP addresses (if any).
  • Source network filtering is configured for your IPv4, IPv6, and DoT endpoints.
  • Source network filtering or token authentication are configured for your DoH endpoints.
  • Any enabled endpoints for a DNS location meet security permissions.

You can assign users the Cloudflare Zero Trust DNS Locations Write role to grant them the permission to create and edit secure DNS locations. To allow users to view locations, you must also assign the Cloudflare Zero Trust Read Only role. Users with these roles can view any DNS location, but can only create or edit secure locations.

Roles that supersede Cloudflare Zero Trust DNS Locations Write include:

  • Cloudflare Gateway
  • Cloudflare Zero Trust
  • Super Administrator

Limitations

Captive portals

Third-party filtering

这篇文档对你有帮助吗？
想留言或继续讨论？请到 Cyberforums 赛博论坛参与。 参与讨论 / 回复