Valérian de Thézan de Gaussan
I’ve seen 1.1.1.2 pop up quite a few times on social media recently.
That caught my attention because, like probably a lot of people, I only knew about the usual 1.1.1.1.
So I started wondering: is 1.1.1.2 actually a thing, or did everyone suddenly start repeating the same random IP address?
Turns out it is very much a thing, and the difference is actually useful.
1.1.1.1: the one most people know
1.1.1.1 is Cloudflare’s public DNS resolver.
When you type a domain name into your browser, DNS is the system that figures out which IP address your device should actually connect to.
You are probably using the DNS servers provided by your ISP unless you changed them yourself. Cloudflare offers 1.1.1.1 as a fast, privacy-focused alternative.
Nothing too surprising here.
The important part for this post is that 1.1.1.1 does not filter websites.
1.1.1.2: same DNS, with some filtering
1.1.1.2 is part of 1.1.1.1 for Families.
It behaves like a regular DNS resolver, except Cloudflare also blocks domains known to be associated with malware or phishing.
If you try to resolve a domain Cloudflare considers malicious, you do not get its real IP address back.
That means the connection gets stopped at the DNS level, before your browser even reaches the site.
I quite like this approach because there is almost nothing else to configure. Change your DNS server and you immediately get an extra security layer.
But wait, there is more
There is also 1.1.1.3.
It does the same malware and phishing filtering as 1.1.1.2, but also blocks adult content.
So the whole thing is surprisingly easy to remember:
1.1.1.1: no filtering1.1.1.2: malware and phishing1.1.1.3: malware, phishing, and adult content
The secondary addresses follow the same pattern:
1.0.0.11.0.0.21.0.0.3
And no, there is no 1.1.1.4 (yet?).
How does Cloudflare know what to block?
Obviously, the interesting question is who decides whether a domain is malicious.
Cloudflare uses its threat intelligence systems to classify domains and detect suspicious ones.
That includes internal data, reputation signals, machine learning, commercial feeds, and public threat intelligence sources.
Cloudflare also sits in a fairly unique position on the Internet. Because so much traffic passes through its infrastructure, it has a lot of signals available to identify suspicious activity.
Of course, DNS filtering is not magic.
It will not replace browser protections, security updates, or someone thinking twice before opening totally-legit-invoice.zip.
But for something that takes roughly a DNS change to enable, 1.1.1.2 is a pretty cheap extra layer of protection.
I knew about 1.1.1.1 for years and somehow completely missed this so I wanted to share.
So yes, the .2 is real. And it is probably the more interesting one.