What happened next: the deprecation of ANY
Apr 13, 2016Ólafur Guðmundsson

Summary
This post details Cloudflare's decision and implementation to deprecate the DNS ANY query type. It explains the rationale behind this decision, including the lack of legitimate use, abundance of malicious use, and its role in DNS amplification DDoS attacks. The post discusses the conversation within the DNS community regarding the interpretation of ANY queries and the high cost of answering them, especially with DNSSEC. It outlines the chosen approach of returning a "harmless" HINFO record to recursive resolvers, which is small and cacheable, thereby reducing amplification potential. This approach is documented in the IETF draft 'Refuse ANY'.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available