Cloudflare DNS blocks malware and phishing on your router
A security researcher recommends switching your router's DNS to Cloudflare's malware-blocking addresses. This stops every device on your home network from reaching known malware and phishing sites, without installing any software.
- Report priority
- Medium
How it works
A router normally hands out its internet provider's default DNS resolver to every connected device, and that resolver does not filter out malicious domains, so devices can freely look up and reach phishing or malware sites.
What to do
Check your router's Internet, WAN, LAN, DHCP, or DNS settings page to see which DNS resolver addresses it currently hands out to devices. If it is using your ISP's default resolver, none of the traffic is being filtered for malware or phishing domains. Cloudflare provides test domains on its own site to confirm whether filtering is active once you change the settings.
Replace the router's DNS resolver entries with 1.1.1.2 as primary and 1.0.0.2 as secondary for malware and phishing filtering only, or use 1.1.1.3 and 1.0.0.3 if you also want adult content blocked, then save and reconnect a device to confirm. Note this does not replace antivirus software, patching, or a password manager, and a VPN, cellular connection, or a device with its own hard-coded DNS will bypass it entirely.
Technical details
Cloudflare's filtered resolvers (1.1.1.2/1.0.0.2 for malware and phishing, 1.1.1.3/1.0.0.3 adding adult content) return 0.0.0.0 for domains on Cloudflare's threat-classification lists instead of resolving them normally, causing the connection attempt to fail at the DNS lookup stage. Setting these at the router's DHCP/DNS configuration applies the filter to every device that obtains DNS automatically from the local network, with no per-device agent or subscription. Cloudflare also supports IPv6 addresses and DNS-over-HTTPS/DNS-over-TLS for compatible clients. The control only affects classified domains and only devices actually using the router's resolver; VPNs, cellular data, and devices with hard-coded or encrypted DNS settings bypass it.