Why can't a different resolver list fix DNS checks from these countries?

Because the problem isn't which resolvers are reliable — it's that the host's own network path to those specific countries is blocked at the network level, below anything a resolver whitelist controls. No amount of resolver-swapping reaches a connection that never leaves.

Is the Cloudflare Worker relay a security risk?

No — it requires a bearer token and only accepts queries for a fixed list of seven specific resolvers, so it can't be used to relay arbitrary DNS traffic anywhere else.

Does this affect every DNS check, or only specific resolvers?

Only seven specific resolvers (Yandex, two 114DNS addresses, two AliDNS addresses, and HiNet) are routed through the relay. Every other resolver is queried exactly as before, with no change in behavior.

Why DNS Checks Fail From Russia, China and Taiwan (and How We Fixed It)

Sometimes a DNS check doesn't fail because of anything wrong with DNS. It fails because the network path to the resolver is blocked before the query ever leaves — and no amount of retrying or resolver-swapping changes that.

The Problem We Found

Testing directly from the production host, not just in theory, showed that its network drops port 53 (both UDP and TCP), DoH and DoT entirely to resolvers in Russia, China and Taiwan.

The Scale of It

40 resolvers were affected — Yandex, 114DNS, AliDNS, Baidu, HiNet, Quad101, Rostelecom, MSK-IX and more all timed out. Only DNSPod and KT answered directly.

Why a Different Resolver List Couldn't Fix This

This isn't a question of which resolvers are generally reliable — it's the host's own network path to specific countries being blocked at a level no resolver whitelist can reach. Swapping which resolvers are queried changes nothing when the connection itself never leaves.

The Actual Fix

A Cloudflare Worker (app/probe-worker) repeats the DNS query over TCP/53 from Cloudflare's own network, which isn't subject to the same block, and returns the raw reply back to our backend.

Which Resolvers Go Through the Relay

Seven specific resolvers are routed this way — Yandex, 114DNS (two addresses), AliDNS (two addresses) and HiNet — via queryViaProbe in probe.go, and only when the PROBE_URL and PROBE_TOKEN environment variables are actually configured. Without them, nothing changes; every other resolver is queried exactly as before.

Why This Isn't an Open Proxy

The Worker requires a bearer token and only accepts queries for that fixed list of seven resolvers — it can't be used to relay arbitrary DNS traffic to anywhere else.

The Free-Plan Limits That Shape the Design

Cloudflare's free Workers plan allows 100,000 requests a day, 10ms of CPU time, 50 subrequests and 6 simultaneous connections per invocation — which works out to roughly 3,500 checks a day at 28 Worker calls each.

Try a Propagation Check

Run a propagation check →Next: We tested 58 public resolvers →

Try it on your domain

See the theory in practice — run a DNS Propagation Checker for your own domain.