Cloudflare runs two filtered versions of its 1.1.1.1 DNS resolver, branded as 1.1.1.1 for Families. They are free and need no account. You change a DNS address, and lookups for known bad domains stop working.
This guide lists every address Cloudflare publishes, explains which one to pick, and walks through setup on the places people actually change DNS.
1.1.1.1 vs 1.1.1.2 vs 1.1.1.3
| Resolver | Blocks | IPv4 | IPv6 |
|---|---|---|---|
| 1.1.1.1 | Nothing | 1.1.1.1, 1.0.0.1 | 2606:4700:4700::1111, 2606:4700:4700::1001 |
| 1.1.1.2 (Families, malware) | Malware and phishing | 1.1.1.2, 1.0.0.2 | 2606:4700:4700::1112, 2606:4700:4700::1002 |
| 1.1.1.3 (Families, malware + adult) | Malware, phishing and adult content | 1.1.1.3, 1.0.0.3 | 2606:4700:4700::1113, 2606:4700:4700::1003 |
Source: Cloudflare’s 1.1.1.1 setup docs and IP address list.
Cloudflare says the Families resolvers follow the same privacy commitments as plain 1.1.1.1. The only difference is the filter. When a domain is on the block list, the resolver answers 0.0.0.0 instead of the real address, so the connection fails.
Which one to use:
- 1.1.1.2 if you want protection from malware and phishing and nothing else. A reasonable default for a homelab or an adults-only household.
- 1.1.1.3 if kids use the network. It includes everything 1.1.1.2 blocks.
Encrypted endpoints: DoH and DoT
Plain DNS travels unencrypted, so your ISP can see and change it. Both Families options also have encrypted endpoints:
| Option | DNS over HTTPS (DoH) | DNS over TLS (DoT, port 853) |
|---|---|---|
| Malware only | https://security.cloudflare-dns.com/dns-query | security.cloudflare-dns.com |
| Malware + adult | https://family.cloudflare-dns.com/dns-query | family.cloudflare-dns.com |
Use these wherever a device or router offers “encrypted DNS”, “secure DNS” or “private DNS”.
Before you change anything
Write down the DNS addresses you have now. Every Cloudflare guide says this, and it’s good advice: if something breaks, you want to put the old values back in a minute.
Also expect trouble with captive portals (hotel and café Wi-Fi login pages) if you hard-code DNS on a laptop or phone. Cloudflare’s fix is to remove the manual DNS, log in to the Wi-Fi, then add it back.
Router: cover the whole network at once
Setting DNS on the router covers every device that takes its settings from the router. You don’t have to touch each phone and laptop.
- Open the router admin page. Common addresses are
192.168.1.1(Linksys, Asus, Netgear),192.168.0.1(D-Link) and192.168.88.1(MikroTik). - Find the DNS settings. Cloudflare notes they’re often under WAN or IPv6 on Asus, IP on MikroTik, and Internet on Netgear.
- Enter the IPv4 pair (
1.1.1.3and1.0.0.3, or the.2pair). - If your network uses IPv6, enter the matching IPv6 pair too. Skipping this is the most common mistake: devices will happily send lookups over IPv6 to your ISP’s resolver and bypass the filter.
- Save, then reconnect a device and test (see below).
On OpenWrt or a FRITZ!Box (FRITZ!OS 7.20 or later) you can use DoT with the hostnames above. Cloudflare’s router guide links to both.
Windows 10 and 11
Windows 11: Settings → Network & internet → pick your Wi-Fi or Ethernet adapter → DNS server assignment → Edit → switch from Automatic (DHCP) to Manual. Turn on IPv4 and enter the two IPv4 addresses, turn on IPv6 and enter the two IPv6 addresses, then Save.
Windows 10: Settings → Network and Internet → Change adapter options → right-click your adapter → Properties. Open Internet Protocol Version 4 → Properties → “Use the following DNS server addresses”, enter the IPv4 pair. Repeat under Internet Protocol Version 6 with the IPv6 pair.
Full steps: Cloudflare’s Windows guide.
macOS
System Settings → Network → select the service (Wi-Fi or Ethernet) → Details → DNS. Under DNS Servers, add the IPv4 and IPv6 addresses for the option you chose and click OK.
This applies per network service, so set it on both Wi-Fi and Ethernet if you use both. Cloudflare’s macOS guide has the same steps.
iPhone and iPad
You have two routes.
The 1.1.1.1 app (works on cellular too). Install “1.1.1.1: Faster Internet” from the App Store, accept the terms and install the VPN profile. Then open the menu → Advanced → Connection options → DNS settings → 1.1.1.1 for Families and pick the option you want.
Manual, Wi-Fi only. Settings → Wi-Fi → tap the (i) next to your network → Configure DNS → Manual → Add Server, and enter the addresses. This only affects that one Wi-Fi network and does nothing on cellular, so it’s a weak choice for a child’s phone.
Source: Cloudflare’s iOS guide.
Android
Android 9 and later: Private DNS. Settings → Network & internet → Advanced → Private DNS → “Private DNS provider hostname”. Enter family.cloudflare-dns.com (malware + adult) or security.cloudflare-dns.com (malware only) and save. This uses DoT and follows the phone onto every network, including mobile data. Menu names vary a little between phone makers.
The 1.1.1.1 app works the same way as on iPhone: menu → Advanced → Connection options → DNS settings → 1.1.1.1 for Families.
Older Android versions need a static IP on each Wi-Fi network, which is fiddly. Cloudflare’s Android guide covers it.
Pi-hole and AdGuard Home upstreams
If you already run a local DNS filter, keep it. Point its upstream at Cloudflare for Families and you get your own block lists plus Cloudflare’s.
Pi-hole (v6): in the admin page go to Settings → DNS. Untick any preset upstream servers, then put the Families addresses in the Custom DNS servers box, one per line: 1.1.1.3 and 1.0.0.3, plus 2606:4700:4700::1113 and 2606:4700:4700::1003 if you use IPv6. Save. Pi-hole’s own upstream providers page lists the same addresses. If you run Pi-hole in Docker with FTLCONF_dns_upstreams set, the web setting is read-only, so change the variable instead (config reference). Pi-hole sends plain DNS upstream, so for encryption you need a local forwarder such as cloudflared in between.
AdGuard Home: Settings → DNS settings → Upstream DNS servers. AdGuard Home accepts encrypted upstreams directly (upstream docs), so you can enter:
https://family.cloudflare-dns.com/dns-query
tls://family.cloudflare-dns.comSwap family for security if you only want malware blocking. Put 1.1.1.3 and 1.0.0.3 in the Bootstrap DNS servers field on the same page so AdGuard Home can resolve the hostname.
One thing to know: Cloudflare’s filtering happens upstream, so Pi-hole or AdGuard Home will log the query as allowed and return the 0.0.0.0 answer it received. If a site breaks, check both layers.
Test that filtering works
Cloudflare runs two test domains:
- malware.testcategory.com should fail to load on both 1.1.1.2 and 1.1.1.3.
- nudity.testcategory.com should fail to load on 1.1.1.3 only.
If both load, the device isn’t using the new resolver. Usual causes: missing IPv6 addresses, a browser using its own secure DNS setting, a VPN, or the device holding an old DHCP lease. Reconnect to the network and try again.
If a legitimate site gets blocked (or a bad one gets through), Cloudflare links an anonymous feedback form from its setup page.
Limits worth knowing
- DNS filtering is easy to bypass for anyone who can change DNS settings, use a VPN, or turn on a browser’s own secure DNS. It’s a safety net, not a parental control lock.
- It blocks whole domains. It can’t filter individual pages or videos on a site it allows.
Quick checklist
- Saved your current DNS addresses
- Picked 1.1.1.2 (malware) or 1.1.1.3 (malware + adult)
- Set IPv4 and IPv6 on the router, or on each device
- Used Private DNS or the 1.1.1.1 app on phones that leave the house
- Pointed Pi-hole or AdGuard Home upstreams at Families, if you run one
- Tested with the testcategory.com domains