Announcing experimental DDR in 1.1.1.1
Mar 8, 2022Christopher Wood, Anbang Wen
Summary
This post introduces experimental support for Discovery of Designated Resolvers (DDR) on Cloudflare's 1.1.1.1 resolver. DDR enables clients to discover and automatically upgrade to encrypted DNS transports (DoT/DoH) by leveraging certificate-based authentication and SVCB records. This mechanism verifies that the designated encrypted resolver is authoritative for the original resolver's IP address, providing a secure upgrade path against active network attackers.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available