What data leaves my browser?+
After you complete Turnstile and click Lookup, the hostname, selected record types, and one-time token go to same-origin /dns-api. DNS query and answer packets then transit Cloudflare's fixed DNS-over-HTTPS resolver. The application keeps no query history and does not cache, persist, or intentionally log the payload.
Which DNS record types can I request?+
The closed list is A, AAAA, CNAME, MX, TXT, NS, CAA, SRV, SOA, and PTR. The endpoint rejects other types and extra request fields.
Can I choose a resolver or nameserver?+
No. The Worker can contact only Cloudflare's fixed DNS-over-HTTPS endpoint. It does not accept a URL, resolver, nameserver, or raw DNS packet from the browser.
Does the lookup visit the hostname?+
No. It asks for DNS records only; it does not make an HTTP request to the hostname, scan it, or prove that a service is reachable.
Why must I complete Turnstile each time?+
A fresh challenge is an abuse control for every lookup. The token is consumed and reset after each submission attempt, including failures.