Cloudflare brings private DNS into its Zero Trust control plane

Why it matters

Internal DNS gives Cloudflare a deeper hold inside enterprise networks by turning private naming into another Gateway policy function, though customers accept greater provider concentration.

Cloudflare made Internal DNS generally available, bringing private authoritative DNS and recursive resolution onto the network and control plane that already runs its public DNS, Gateway and Zero Trust products.

The release carries forward the original bet made by Matthew Prince, Michelle Zatlyn and Lee Holloway when they founded Cloudflare in 2009: network infrastructure would move from hardware owned by customers to services delivered through a shared cloud platform. Internal DNS applies that thesis to a piece of enterprise infrastructure that often remains scattered across appliances, Microsoft environments and separate cloud providers.

Cloudflare's launch post frames the product as operational consolidation. An administrator can manage public and private records through one API, apply Gateway policies to private name resolution, and use a common audit trail instead of synchronizing multiple DNS systems.

Cloudflare says Internal DNS is included without an additional charge for Enterprise customers that already use Cloudflare Gateway. Cloudflare disclosed no customer count, query volume, revenue contribution or stand-alone price for the product.

The founders' hardware thesis reaches private naming

Prince and Zatlyn wrote in their 2019 founders' letter that Cloudflare was designed around the shift from purchased network appliances to rented cloud services. Firewalls, load balancers and network optimizers were all expected to move onto a common platform running on commodity hardware.

Private DNS fits that playbook. Large organizations frequently operate public DNS through one provider, private zones on internal servers and additional resolvers inside AWS, Microsoft Azure or Google Cloud. Split-horizon configurations add another layer: the same hostname may need to return different records depending on whether the request comes from an employee device, a production workload or the public internet.

That fragmentation creates a sales opening for Cloudflare. An Enterprise Gateway customer already routes DNS requests through Cloudflare's policy engine. Adding internal authoritative zones gives Cloudflare another reason for that customer to move a foundational network function onto the same account and traffic path.

The inclusion in Gateway pricing also lowers the initial procurement hurdle. Cloudflare can sell Internal DNS as an extension of an existing Zero Trust deployment rather than a separate infrastructure project, even though migration from legacy DNS servers may still require substantial planning.

How Internal DNS handles a query

Cloudflare's documentation describes an Enterprise-only architecture that depends on Cloudflare Gateway. Internal zones receive no Cloudflare nameservers and can be queried only through the Gateway resolver.

The product has two principal components. Gateway Resolver receives the query, evaluates policy and either blocks it, sends it to an internal view or leaves it on the public resolution path through 1.1.1.1. Internal Authoritative DNS stores and serves records for private resources such as databases, internal applications and service endpoints.

Administrators configure three main objects:

• Internal Zones contain private DNS records.
• DNS Views group zones into the version of the namespace that a particular user or device should see.
• Resolver Policies select a view based on context such as the query source.

Cloudflare also supports zone references, allowing one internal zone to be reused across multiple views. That matters for split-horizon DNS because administrators can define a shared set of records once instead of copying them into several environments and waiting for those copies to drift apart.

Changes from the dashboard, Terraform or direct API calls enter through the same DNS Records API. Cloudflare says it validates those changes, replicates them across its network and invalidates affected cached entries so edits take effect within seconds rather than waiting for a time-to-live period to expire. That propagation speed is a Cloudflare claim; the launch material provides no independent benchmark or service-level commitment for Internal DNS updates.

Cloudflare is competing with broader DDI platforms

Internal DNS covers DNS resolution, private authoritative records and policy. It does not include the DHCP and IP address management functions commonly sold with DNS as a DDI suite.

That distinction separates Cloudflare from vendors that manage a wider portion of enterprise network addressing. Infoblox Universal DDI manages DNS, DHCP and IPAM across hybrid environments. Infoblox also promotes integrations with external DNS providers, including Cloudflare, which lets customers centralize management without moving every DNS workload onto one provider's infrastructure.

BlueCat Horizon similarly combines DNS, DHCP, IPAM, security and observability. BlueCat says Horizon can orchestrate Microsoft Active Directory, BIND, Kea and cloud DNS while using optional on-premises service points for local policy enforcement and data-sovereignty requirements. EfficientIP's SOLIDserver retains physical and virtual appliance options for DNS, DHCP, IPAM and related network services.

Cloudflare's narrower scope comes with a simpler strategic pitch: customers already using Gateway can put internal DNS policy and records beside the public DNS and Zero Trust controls they use today. For organizations seeking full IP address lifecycle management or cloud-managed orchestration of existing third-party DNS servers, the established DDI vendors cover functions Cloudflare has not announced.

Cisco is also pulling private DNS deeper into Zero Trust. An April 2026 Cisco Secure Access release added DNS steering for SRV records and private workflows involving Active Directory, Kerberos and LDAP. The common direction is clear: private name resolution is becoming a policy function inside cloud-delivered access platforms.

Consolidation increases the stakes of Cloudflare's control plane

A shared control plane reduces duplicated configuration and gives security teams one place to inspect policy. It also concentrates operational dependency.

Cloudflare documented that a bad Bot Management configuration file caused a global outage on November 18th, 2025. The file propagated across Cloudflare's network and triggered failures in the core proxy, with downstream effects on Workers KV and Access. Internal DNS was not implicated in that incident, but the outage showed the potential reach of a configuration error on a globally distributed platform.

Cloudflare has continued investing in the systems that move control-plane writes across that network. RuntimeWire reported on July 10th that its Meerkat research project uses the QuePaxa consensus algorithm to keep writes moving when replicas or network paths become slow.

Internal DNS places another critical enterprise function inside that architecture. For Prince, Zatlyn and Cloudflare's product team, that is the point: each appliance retired expands the value of the shared network. Customers receive fewer systems to operate, while Cloudflare becomes responsible for a larger portion of the path employees and applications use to find private services.