Does Cloudflare DNS Work in China? Resolution vs. the ICP Door
Cloudflare DNS resolves for China users off its global anycast network with no ICP — but resolving a name is not in-country delivery, and not compliant. A compliance-first look at the ICP door DNS does not clear.
Does Cloudflare DNS work in China?
Whether Cloudflare DNS "works" in China is two questions, and only the second one bites: the name resolves, but resolving it does not make your site in-country or compliant. The deciding door is an ICP filing plus lawful in-country delivery — not DNS.
Cloudflare's authoritative DNS is a global anycast service — it answers "from a data center physically close to the user," and Cloudflare's DNS pages say nothing about China or an ICP, so ordinary resolution is not the blocker. The China question starts one layer down. Cloudflare's own China Network docs show the in-country version — "In-China Authoritative DNS and in-China nameservers" — is part of a separate, licensed network "operated by Cloudflare's partner JD Cloud," and that "you must have a valid ICP ... filing or license for each apex domain you wish to onboard." A domain can resolve worldwide without any Chinese permission; it is the act of serving the content that name points to from inside the mainland that the law meets with an ICP filing — the very door Cloudflare places its own in-China nameservers behind. To the extent your DNS analytics or query logs carry personal data across the border, the PIPL cross-border rules are a separate, secondary question. The table below is Cloudflare's own wording.
This is a risk picture, not legal advice — your ICP route turns on whether your site merely informs or actually sells. Have our China team pressure-test your DNS and ICP standing with you →
Compliance snapshot
- ✓ Cloudflare's global authoritative DNS resolves for China users off its anycast network
- ! Resolving a name is not the same as serving your site in-country — or lawfully
- ✕ DNS alone puts no content in-country and clears no ICP obligation
- ! The in-country speed benefit (in-China nameservers) rides the ICP-gated China Network
- ✓ A compliant path exists — ICP filing plus ICP-filed in-country delivery
What Cloudflare DNS's documentation says, and what we measured from inside China
| Fact | Primary source |
|---|---|
| In Cloudflare's own words, its authoritative DNS is a global service: "Cloudflare DNS is a fast, resilient, and easy-to-manage authoritative DNS service," and "our massive anycast network responds to queries from a data center physically close to the user." Cloudflare's DNS product and developer-docs pages describe a worldwide anycast service and make no mention of China or an ICP filing — ordinary resolution answers for mainland users off the global network, so a name resolving is not the China question (21YunBox note). | Cloudflare — DNS product page and DNS developer docs, retrieved 2026-10-07 |
| The in-country version is a separate, licensed product. Cloudflare's China Network runs "selected Cloudflare performance and security products on data centers located in Mainland China, operated by Cloudflare's partner JD Cloud," and lists among its features "In-China Authoritative DNS and in-China nameservers to reduce the time it takes for a user's browser to start receiving content (Time to First Byte)." The DNS that actually sits inside the mainland is part of the China Network — not Cloudflare's ordinary global edge. | Cloudflare Docs — Cloudflare China Network (overview, Main features), retrieved 2026-10-07 |
| The gate, verbatim: "You must have a valid ICP (Internet Content Provider) filing or license for each apex domain you wish to onboard to Cloudflare." Cloudflare's ICP page adds that the obligation applies "whether the site is hosted on a server in Mainland China or delivered to visitors in China through a CDN" — it attaches to serving the site in-country, which is why in-China DNS is gated by it and why resolving a name offshore does not clear it. See ICP. | Cloudflare Docs — Cloudflare China Network (overview) + Internet Content Provider (ICP), retrieved 2026-10-07 |
| The ICP is a legal regime, not a setting. Cloudflare states the ICP system "is a licensing regime established by the Telecommunications Regulations of the People's Republic of China" — a filing (备案) for informational sites, a license (ICP证) for sites that sell. "As a US company, Cloudflare does not have a license from China's Ministry of Industry and Information Technology (MIIT)"; its partner JD Cloud holds the required licenses. And if the ICP lapses, Cloudflare "will reroute the traffic for the affected domains to the nearest data centers outside of China" — in-country delivery falls back offshore. | Cloudflare Docs — Internet Content Provider (ICP) + China Network FAQ, retrieved 2026-10-07; Telecommunications Regulations of the PRC (State Council Order 292 / MIIT Order 33) |
Read a delivery measurement correctly: from a probe inside mainland China (Alibaba Cloud cn-zhangjiakou) on 2026-08-28, Cloudflare's own global site completed 3 of 6 load attempts, with a median time to first byte of 1,011ms and a median largest-contentful-paint of 3.1s on the runs that finished. This measures Cloudflare's offshore content edge reached from the mainland — not DNS resolution, which is a lightweight query answered off the global anycast network. The intermittency is the in-country delivery gap the ICP-gated China Network exists to close; DNS resolving does not touch it. (Machine-room line — a lower bound, not a worst case.) | 21YunBox — China delivery measurement, measured from inside mainland China (Alibaba Cloud cn-zhangjiakou; 6 runs, 2026-08-28) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
Whether Cloudflare DNS “works” in mainland China is really two questions, and only the second one bites. The name resolves: Cloudflare’s authoritative DNS answers users in China from its global anycast network, with no Chinese license in the loop — so by the one test most teams run, it looks like a clean pass. What that pass does not tell you is whether the site the name points to is actually served from inside the mainland, or served lawfully. That is the deciding door — an ICP filing and in-country delivery — and it is the very door Cloudflare puts its own in-China nameservers behind. Each claim below is in Cloudflare’s own words.
Cloudflare DNS in China at a glance
| What decides it | In Cloudflare's own terms |
|---|---|
| Does the name resolve? | Cloudflare's authoritative DNS is “a fast, resilient, and easy-to-manage authoritative DNS service” answering from a “massive anycast network … physically close to the user.” Its DNS documentation makes no mention of China or an ICP — ordinary resolution is not the blocker. |
| Does resolving mean in-country? | No. The DNS that physically sits inside the mainland — “In-China Authoritative DNS and in-China nameservers” — is a feature of the Cloudflare China Network, “operated by Cloudflare's partner JD Cloud,” not the ordinary global edge. |
| The gate on in-country delivery | “You must have a valid ICP (Internet Content Provider) filing or license for each apex domain you wish to onboard to Cloudflare.” It applies “whether the site is hosted on a server in Mainland China or delivered to visitors in China through a CDN.” |
| Whose license operates it | “As a US company, Cloudflare does not have a license from China's Ministry of Industry and Information Technology (MIIT)”; its “partner JD Cloud has all the licenses required by the MIIT.” You hold the ICP; the partner holds the operating license. |
| If the ICP goes inactive | Cloudflare “will reroute the traffic for the affected domains to the nearest data centers outside of China” — in-country delivery drops back to the offshore path. |
A resolving domain is not an in-country one
Start with what actually happens when a browser in Shanghai looks up your domain. Cloudflare’s authoritative DNS is, in its own description, “a fast, resilient, and easy-to-manage authoritative DNS service,” and its “massive anycast network responds to queries from a data center physically close to the user.” Nothing in Cloudflare’s DNS product or developer documentation mentions China or an ICP, because answering a lookup is a lightweight query the global network handles like any other. So the name resolves, and the box most audits tick — “does DNS work in China?” — gets ticked.
The trouble is what that tick does not cover. Resolving a name only hands the browser an address; it places none of your content inside the mainland and clears none of China’s licensing. A domain can answer worldwide without a single Chinese permission, yet still have nothing lawful behind it in-country. Reachability and compliant in-country delivery are different questions, and only the first is settled by a successful lookup.
The in-country DNS is part of the ICP-gated China Network
Cloudflare does offer DNS that genuinely sits inside the mainland — but it is not a property of your ordinary zone. Its China Network runs “selected Cloudflare performance and security products on data centers located in Mainland China, operated by Cloudflare’s partner JD Cloud,” and names “In-China Authoritative DNS and in-China nameservers” among that network’s features. The in-country DNS, in other words, is one piece of the China Network, delivered on a Chinese partner’s licensed infrastructure — not something your current nameservers do on their own.
And the China Network turns on a single requirement Cloudflare states without hedging: “You must have a valid ICP (Internet Content Provider) filing or license for each apex domain you wish to onboard to Cloudflare.” That obligation is not about where your DNS answers from — Cloudflare notes it applies “whether the site is hosted on a server in Mainland China or delivered to visitors in China through a CDN.” It attaches to serving the site in-country, which is exactly why the in-China nameservers are gated by it while plain resolution is not. Onboarding depends on the ICP filing; it never stands in for it.
Cloudflare also does not supply that license. “As a US company, Cloudflare does not have a license from China’s Ministry of Industry and Information Technology (MIIT). However, Cloudflare’s partner JD Cloud has all the licenses required by the MIIT to operate and provide CDN services in China.” Lawful in-country delivery therefore runs on the partner’s MIIT-licensed network under an ICP that is yours to hold — the regime set by the Telecommunications Regulations of the People’s Republic of China (State Council Order No. 292 and MIIT Order No. 33). A filing (备案) covers a site that only informs; a license (ICP证) is what a site selling goods or services must hold.
If the ICP lapses — and the PIPL question in DNS logs
The ICP is load-bearing for as long as you serve China. Cloudflare spells out the consequence of letting it go: it “will reroute the traffic for the affected domains to the nearest data centers outside of China.” The moment the filing goes inactive, the in-country delivery the China Network provided drops back to the offshore path — your name keeps resolving, but what it resolves to is once again served from outside the mainland.
DNS raises one more question, and it is a secondary one: your records themselves carry no personal data, but DNS query logs and analytics can. To the extent those logs move personal information out of China, the cross-border transfer rules under PIPL — notice, separate consent and a transfer mechanism — fall to you as the handler. It is a narrower exposure than hosting or CDN delivery, but it belongs on the same checklist.
None of this is a verdict a web page can issue. Whether your case needs an ICP filing or a full ICP license turns on what your site does and who operates it, and the DNS-log question turns on what you actually log — all of it worth settling with counsel before you treat a resolving domain as proof you are covered.
Where 21YunBox fits — a compliant overlay, not a migration
You keep your DNS on Cloudflare exactly as it is. What we add is the half a resolving domain leaves unanswered: a valid ICP and lawful, ICP-filed delivery from inside the mainland, placed in front of the origin your records already point to — nothing to rebuild and no parallel setup to run. Our China team checks each domain’s ICP standing, tells you whether your case calls for a filing or a license, stands up the in-country delivery your DNS points at, and flags any cross-border personal-data exposure hiding in your DNS analytics. It sits alongside your global Cloudflare configuration, not against it.
Related reading:
Frequently Asked Questions
Does Cloudflare DNS resolve for visitors in mainland China?
Yes. Cloudflare's authoritative DNS answers from its global anycast network "from a data center physically close to the user," and its DNS documentation says nothing about China or an ICP — ordinary resolution is not the blocker. The catch is what resolution does not do: pointing a name at your servers does not place your content inside the mainland or satisfy Chinese licensing. Reachability and lawful in-country delivery are separate questions.
Is it against the law to use Cloudflare DNS in China?
Not inherently — DNS resolution is not the act China's ICP regime attaches to. That obligation attaches to serving a site from inside the mainland (in Cloudflare's own words, "whether ... hosted on a server in Mainland China or delivered to visitors in China through a CDN"). So the risk is not in running Cloudflare DNS; it is in assuming a resolving domain means you are in-country and compliant. To the extent Cloudflare's DNS analytics or query logs carry personal information across the border, that is a separate PIPL cross-border question. Treat this as a risk to assess with counsel, not a blanket prohibition.
Can 21YunBox help get Cloudflare DNS working compliantly in China?
Yes. Our China team can confirm whether your case needs an ICP filing (备案) or a license (ICP证), check your current standing, stand up the ICP-filed in-country delivery your DNS records point to, and flag any cross-border personal-data exposure in your DNS analytics. Get in touch and we'll map your specific path.
