August 12, 2026Mingtindu Sherpa6 min read

Configure Cloudflare DNS on Ubuntu

Configure Cloudflare's resolver on an Ubuntu device and separately manage authoritative Cloudflare DNS records for a domain.

On this page

“Configure Cloudflare DNS on Ubuntu” describes two unrelated changes: an Ubuntu device can use Cloudflare's public recursive resolver, or a domain owner can host authoritative DNS records at Cloudflare. Changing the laptop's resolver does not change where a domain points, and changing a domain's records does not configure the laptop's resolver.

Which DNS setting do you need?

Goal	Setting changed	Who observes it
Resolve names through 1.1.1.1	Ubuntu network connection	That device's DNS lookups
Point `app.example.com` at a server	Cloudflare zone record	Internet clients after delegation/cache updates

The first section covers the device. The second covers the domain.

Use Cloudflare's public resolver on Ubuntu

Cloudflare's standard resolver addresses are:

IPv4: 1.1.1.1, 1.0.0.1
IPv6: 2606:4700:4700::1111, 2606:4700:4700::1001

First identify the active NetworkManager connection. The connection profile name is not necessarily the interface name:

nmcli connection show --active
nmcli device status

Assume the active profile is named Wired connection 1. Preserve its current settings before editing:

nmcli connection show "Wired connection 1"

Configure IPv4 DNS and tell NetworkManager not to accept resolver addresses supplied by DHCP:

sudo nmcli connection modify "Wired connection 1" \
  ipv4.ignore-auto-dns yes \
  ipv4.dns "1.1.1.1 1.0.0.1"

If the connection actually uses IPv6, configure its resolvers too:

sudo nmcli connection modify "Wired connection 1" \
  ipv6.ignore-auto-dns yes \
  ipv6.dns "2606:4700:4700::1111 2606:4700:4700::1001"

Do not enable IPv6 merely to add these addresses. If IPv6 is intentionally disabled or unavailable, retain that network policy.

Reconnect the profile. This interrupts network access, so do not do it casually over a remote SSH session:

sudo nmcli connection down "Wired connection 1"
sudo nmcli connection up "Wired connection 1"

Editing /etc/resolv.conf directly is often temporary because NetworkManager, DHCP, or systemd-resolved can overwrite it. Configure the component that owns DNS on the actual Ubuntu installation.

Verify the local resolver

nmcli device show | grep -E 'IP4.DNS|IP6.DNS'
resolvectl status
dig example.com

resolvectl may show the local stub 127.0.0.53; inspect the per-link upstream DNS entries too. Query Cloudflare directly to separate resolver behavior from local configuration:

dig @1.1.1.1 example.com

VPN software, split DNS, containers, browsers with DNS over HTTPS, and per-application settings can use a different resolver. Verify from the application that matters.

To restore automatic DNS, remove the manual values and re-enable DHCP-provided resolvers:

sudo nmcli connection modify "Wired connection 1" \
  ipv4.ignore-auto-dns no ipv4.dns "" \
  ipv6.ignore-auto-dns no ipv6.dns ""

Reconnect once more for the profile change to take effect.

Manage a domain's DNS records at Cloudflare

For Cloudflare to answer authoritatively in a full zone setup, add the domain to Cloudflare, review the imported records, then replace the registrar's current nameservers with the two nameservers Cloudflare assigns. Copy those exact assigned names, and avoid deleting working records until the new zone is complete.

Nameserver updates occur at the registrar, not on the Ubuntu server. DNSSEC requires extra care: follow Cloudflare's onboarding instructions so an old DS record does not cause validation failures during the change.

Choose A, AAAA, or CNAME

Record	Value	Typical purpose
`A`	IPv4 address	Point a hostname at an IPv4 origin
`AAAA`	IPv6 address	Point a hostname at an IPv6 origin
`CNAME`	Another hostname	Alias one hostname to another

Only publish an AAAA record when the origin genuinely accepts IPv6 traffic. A non-working IPv6 path can cause failures for clients that prefer it. CNAME targets are hostnames, not complete URLs, paths, or IP addresses.

A typical zone might contain:

Type	Name	Target	Proxy status
A	`@`	origin IPv4 address	Proxied or DNS only
CNAME	`www`	`example.com`	Proxied or DNS only

Cloudflare's dashboard uses @ for the zone apex. Preserve mail-related MX, TXT, DKIM, and verification records while changing web records.

Understand proxy status

For eligible A, AAAA, and CNAME records, Proxied sends supported HTTP traffic through Cloudflare and DNS answers with Cloudflare addresses. DNS only returns the origin target and bypasses Cloudflare's HTTP proxy.

Use DNS only for services or ports that the Cloudflare proxy does not support, and follow the product-specific guidance for mail, SSH, databases, and other non-HTTP services. Proxying a record does not repair an unreachable origin or automatically configure the origin certificate and firewall.

Verify authoritative DNS and propagation

Check which nameservers the parent zone delegates to:

dig NS example.com +short

Query a Cloudflare authoritative server assigned to the zone:

dig @assigned-name.ns.cloudflare.com example.com A
dig @assigned-name.ns.cloudflare.com www.example.com CNAME

Then compare public recursive resolvers:

dig @1.1.1.1 example.com A
dig @8.8.8.8 example.com A
dig +trace example.com

Replace all placeholders with the real public domain and assigned nameserver. A proxied record should return Cloudflare addresses rather than the origin, so verify the HTTP response and certificate as well as the raw DNS answer:

curl --head https://example.com

“Propagation” is usually a combination of registrar delegation updates and caches retaining old answers until their TTL expires. Check the authoritative answer first; repeatedly clearing a laptop cache cannot fix an incorrect authoritative record.

Common mistakes

Expecting 1.1.1.1 on Ubuntu to change a domain's public records.
Editing /etc/resolv.conf while NetworkManager owns the file.
Modifying the wrong inactive connection profile.
Adding an AAAA record without a reachable IPv6 origin.
Putting https:// or a URL path in a CNAME target.
Enabling the proxy for a service that is not supported by Cloudflare's HTTP proxy.
Replacing nameservers before reproducing critical mail and verification records.

Verification checklist

The local-resolver and authoritative-domain goals are treated separately.
The active NetworkManager profile shows the intended IPv4 and IPv6 policy.
Resolver changes survive a controlled reconnection and reboot.
Registrar delegation matches Cloudflare's assigned nameservers.
A, AAAA, and CNAME values match reachable origins or hostnames.
Proxy status fits the protocol and origin security model.
Authoritative, recursive, HTTP, and TLS checks all succeed.

References

Documentation checked on 2026-08-12:

Related writing

LinkedIn Post on X