# Cloudflare DNS privacy rating

Authoritative DNS hosting on Cloudflare's anycast network with a free plan, DNSSEC, an API and security-key login.

**Our pick.** Free on every plan, one of the fastest DNS networks, a complete API, and hardware security key login. DNSSEC is automatic when the domain is also registered with Cloudflare Registrar.

**Keep in mind:** Cloudflare sits in front of a large share of the web. Using it for DNS only (without proxying traffic) keeps site traffic off Cloudflare's servers.

## Summary

Cloudflare DNS scores 66 out of 100 (grade C) on the DNS hosting criteria. It meets 7 of 11 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, DNSSEC, API access and two-factor login. It partly meets independent audit and security headers. It does not meet open source and no trackers or telemetry. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade B+.

- Website: https://www.cloudflare.com/products/dns/
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), Google Tag Manager
- Category: [DNS hosting](https://privacyratings.com/dns-hosting/)
- Also rated: [Cloudflare Email Routing](https://privacyratings.com/email-forwarding/cloudflare-email-routing/) (Email forwarding and aliases), [1.1.1.1](https://privacyratings.com/mobile-security-apps/1-1-1-1/) (Mobile security apps), [Cloudflare](https://privacyratings.com/dns-resolvers/cloudflare/) (DNS resolvers), [Cloudflare Registrar](https://privacyratings.com/domain-registrars/cloudflare-registrar/) (Domain registrars), [Cloudflare Workers](https://privacyratings.com/app-hosting/cloudflare-workers/) (App hosting platforms), [Cloudflare Mesh](https://privacyratings.com/mesh-vpns/cloudflare-mesh/) (Mesh VPNs and private networks), [Cloudflare Web Analytics](https://privacyratings.com/web-analytics/cloudflare-web-analytics/) (Website analytics)
- Grade: C (66/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | The DNS service is closed source. |  |
| No trackers or telemetry | No | The home page loads Google Tag Manager (automated test). |  |
| No ads or data sales | Yes | Funded by paid plans. No ads. | https://www.cloudflare.com/plans/ |
| Independent audit | Partial | SOC 2, ISO 27001 and PCI reports exist but are only available to account administrators in the dashboard. | https://developers.cloudflare.com/fundamentals/reference/policies-compliances/compliance-docs/ |
| Transparency report | Yes | Semi-annual reports with counts of legal requests and responses. | https://www.cloudflare.com/transparency/ |
| Tells users about requests | Yes | The transparency report states customers are notified of legal requests unless legally prohibited. | https://cf-assets.www.cloudflare.com/slt3lc6tev37/zItVXCvbb4LZpYG4Uh10R/7b27bba39755f0a4344acb946977704d/2H_2025_Cloudflare_s_Transparency_Report_Legal-v2.pdf |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=dash.cloudflare.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=dash.cloudflare.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| DNSSEC | Yes | Enabled with one click. The DS record is added automatically for Cloudflare Registrar domains and manually at other registrars. | https://developers.cloudflare.com/dns/dnssec/ |
| API access | Yes | The DNS API is available on every plan, including the free plan. | https://developers.cloudflare.com/api/ |
| Two-factor login | Yes | Security keys and authenticator apps. | https://developers.cloudflare.com/fundamentals/user-profiles/2fa/ |

Source: https://privacyratings.com/dns-hosting/cloudflare-dns/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/dns-hosting/cloudflare-dns.md