Skip to content

Gateway locations

Last updated View as MarkdownAgent setup

DNS locations are a collection of DNS endpoints which can be mapped to physical entities such as offices, homes, or data centers.

The fastest way to start filtering DNS queries from a location is by changing the DNS resolvers at the router.

Add a DNS location

To add a DNS location to Gateway:

  1. In the Cloudflare dashboard ↗︎, go to Zero Trust > Traffic controls > Resolver endpoints.
  2. Select Add a location.
  3. Choose a name for your DNS location.
  4. Choose at least one DNS endpoint to resolve your organization's DNS queries.
  5. (Optional) Toggle the following settings:
    • Enable EDNS client subnet sends a user's IP geolocation to authoritative DNS nameservers. EDNS Client Subnet (ECS) helps reduce latency by routing the user to the closest origin server. Cloudflare enables EDNS in a privacy preserving way by not sending the user's exact IP address but rather the first /24 range of the larger range that contains their IP address. This /24 range will share the same geographic location as the user's exact IP address.
    • Set as Default DNS Location sets this location as the default DoH endpoint for DNS queries.
    • Enable DNS64 requests DNS64 synthesis for queries that match this location. Use this setting for an IPv6-only network with network address translation from IPv6 to IPv4 (NAT64).
  6. Select Continue.
  7. (Optional) Turn on source IP filtering for your configured endpoints, then add any source IPv4/IPv6 addresses to validate.
    • Endpoint authentication is required for standard IPv4 addresses and optional for dedicated IPv4 addresses.
    • DoH endpoint filtering & authentication lets you restrict DNS resolution to only valid identities or user tokens in addition to IPv4/IPv6 addresses.
  8. Select Continue.
  9. Review the settings for your DNS location, then choose Done.

Was this helpful?