iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cloudflare and Google use closely related DNS-over-HTTPS (DoH) JSON formats: Cloudflare says it follows Google’s schema. The practical differences are in their documented request options, diagnostic details, privacy disclosures, and—most urgently for parsers—Cloudflare’s July 28, 2026 rollout of new record-data formatting. If you inspect DNS in a browser or build a client, treat the shared schema as a starting point, not a guarantee that every option or answer will match.
1. Endpoint and browser request mechanics
Cloudflare documents its JSON endpoint as https://cloudflare-dns.com/dns-query. Its JSON request uses GET, puts query parameters in the URL, and specifies the Accept: application/dns-json header. The required parameter is name; if you omit type, the documented default is A. Google also documents a GET-based JSON API, requires name, and defaults type to 1 (A). See Cloudflare’s JSON documentation and Google’s JSON API documentation.
For a browser address bar, try a URL such as https://cloudflare-dns.com/dns-query?name=example.com&type=AAAA. That is convenient for viewing a response, but an address-bar navigation does not let you explicitly set the Accept header. To follow Cloudflare’s documented JSON request mechanics, use a simple HTTP client that can set it:
curl --header "accept: application/dns-json" "https://cloudflare-dns.com/dns-query?name=example.com&type=AAAA"This is an illustrative request based on the documented endpoint and parameters, not a live query. Google’s documentation also describes GET requests for its JSON API; consult its current endpoint instructions when constructing a request.
#1 Best Overall
2. Documented query options
Both providers document the common DNS query parameters name, type, do, and cd. Their documented option sets diverge beyond those basics:
| Option | Cloudflare JSON docs | Google JSON docs |
|---|---|---|
name, type, do, cd |
Documented; name is required and type defaults to A. |
Documented; name is required and type defaults to 1 (A). |
ct |
Not listed in Cloudflare’s JSON-parameter documentation. | Documented for requesting JSON or a binary DNS message. |
edns_client_subnet |
Not listed in Cloudflare’s JSON-parameter documentation. | Documented for passing an EDNS Client Subnet value. |
random_padding |
Not listed in Cloudflare’s JSON-parameter documentation. | Documented for URL padding. |
These are differences in what the cited API documentation describes; they do not establish that every option omitted from a provider’s page is rejected in every deployment. Google says edns_client_subnet can pass network-prefix information to improve geographic answer accuracy. Its documentation notes that a user concerned about sharing part of an IP address with authoritative nameservers can set 0.0.0.0/0. This is an explicit Google API option, not something to assume is automatically sent by a browser.
3. Shared response shape, with provider-specific details
Cloudflare explicitly says it chose to follow the same schema as Google’s DNS-over-HTTPS resolver because the IETF has no agreed JSON schema for DoH. Both document familiar fields such as Status, TC, RD, RA, AD, CD, Question, and Answer. An answer record commonly includes name, type, TTL, and data.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Statusis the DNS response code.Questiondescribes the requested record, whileAnswercontains returned records.TTLis the record’s cache lifetime in seconds; it is not a promise that a response will remain identical for that duration across every resolver or cache.ADrelates to the authenticated-data indication used with DNSSEC validation;CDrelates to checking disabled. Interpret them in the context of the request and resolver documentation rather than as a general guarantee about all DNS security.
Some diagnostic details are provider-specific in the documentation. Google shows an edns_client_subnet top-level response field when that option is used and includes diagnostic comments in examples, such as validation information or attribution to an uncached authoritative nameserver. Cloudflare describes Comment as a list of Extended DNS Error (EDE) messages. The overlapping schema does not mean every response has the same optional fields or comments.
4. Record-data formatting and parser stability
The most significant recent compatibility issue is Cloudflare’s formatting rollout. Its July 28, 2026 changelog says responses may use old or new data formatting during rollout for record types including CAA, NAPTR, RP, IPSECKEY, SVCB, HTTPS, TLSA, SSHFP, and OPENPGPKEY. For affected records, DNSSEC algorithm and digest identifiers change from mnemonics to numeric identifiers; HINFO strings are quoted individually.
This is a rollout-specific Cloudflare implementation change, not evidence that every Cloudflare answer has changed or that Google uses the same presentation. Do not build a parser around one sample string in data. Cloudflare warns that these are breaking changes and that DoH JSON has no formal RFC or guaranteed stable schema; for a stable format, it recommends DoH wireformat. Google also documents a binary DNS-message response option through ct. The sources do not establish that the two wireformat options are otherwise identical in behavior.
Rank #4
5. Privacy claims and choosing an implementation
Both services provide public recursive DNS resolution over HTTPS. The available provider documentation supports a comparison of API behavior, but not a balanced, current ranking of their privacy practices. Cloudflare’s Public DNS Resolver privacy policy says it deletes Public Resolver Logs within 25 hours. It also describes limited access to anonymized data for APNIC operational research, sampled network packets, and aggregated data. That is Cloudflare’s published policy commitment, not proof that it is more private than Google.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor browser inspection or a small script, JSON is convenient because a response can be read without decoding a DNS wire message. For a client where record parsing must remain stable, follow Cloudflare’s recommendation to use DoH wireformat, or evaluate Google’s documented binary-message option. In either case, implement the behavior actually documented by the endpoint you call rather than assuming schema similarity guarantees identical options, answers, or privacy practices.
Best Value
- Used Book in Good Condition
How to read a response without misdiagnosing it
An empty Answer array by itself does not prove the HTTP request failed. Check the layers separately:
- Inspect the HTTP status to see whether the HTTPS request succeeded.
- Read the JSON
Statusfield for the DNS response code. - Check
Questionto confirm the requested name and record type. - Look for optional diagnostics such as
Commentorerror, where present.
A valid DNS response can contain no answer records for a query; transport success and DNS outcome are different things. The response examples and field descriptions are in the Cloudflare and Google documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
