Configure Local Domain Fallback
By default, Cloudflare Zero Trust excludes common top-level domains, used for local resolution, from being sent to Gateway for processing. These top-level domains are resolved by the local DNS resolver configured for the device on its primary interface.
You can add additional domains to the Local Domain Fallback list and specify a DNS server to use in place of the Gateway resolver. The WARP client proxies these requests directly to the configured fallback servers.
Limitations
Local Domain Fallback only applies to devices running the WARP client.
Because DNS requests subject to Local Domain Fallback bypass the Gateway resolver, they are not subject to Gateway DNS policies or DNS logging. If you want to route DNS queries to custom resolvers and apply Gateway filtering, use resolver policies. If both Local Domain Fallback and resolver policies are configured for the same device, Cloudflare will apply client-side Local Domain Fallback rules first.
Manage local domains
View domains
To view the domains subject to Local Domain Fallback:
In Zero Trust, go to Settings > WARP Client.
Under Device settings, locate the device profile you would like to view or modify and select Configure.
Scroll down to Local Domain Fallback and select Manage.
On this page, you will see a list of domains excluded from Gateway. You can add or remove domains from the list at any time.
Add a domain
In Zero Trust, go to Settings > WARP Client.
Under Device settings, locate the device profile you would like to view or modify and select Configure.
Scroll down to Local Domain Fallback and select Manage.
example.com
is interpreted as *.example.com
).In DNS Servers, enter the IP address of the DNS server that should resolve that domain name.
- WARP tries all servers and always uses the fastest response, even if that response is
no records found
. - We recommend specifying at least one DNS server for each domain. If a value is not specified, the WARP client will try to identify the DNS server (or servers) used on the device before it started, and use that server for each domain in the Local Domain Fallback list.
- WARP tries all servers and always uses the fastest response, even if that response is
Enter an optional description and select Save domain.
DNS traffic to the local domain fallback server is routed according to your Split Tunnel configuration. To ensure that queries can reach your private DNS server:
Learn more about how WARP handles DNS requests.
Delete a domain
In Zero Trust, go to Settings > WARP Client.
Under Device settings, locate the device profile you would like to view or modify and select Configure.
Scroll down to Local Domain Fallback and select Manage.
- Find the domain in the list and select Delete.
The domain will no longer be excluded from Gateway DNS policies, effective immediately.