By Greg Nowak. Updated 12 September 2026.
A DNS check can return valid JSON and still give your automation the wrong answer. That is the operational risk behind Cloudflare’s changes to its DNS-over-HTTPS (DoH) JSON responses: the request succeeds, but the code interpreting the result no longer understands it.
For business owners, operations leads and agency teams, the first question is which workflows depend on those answers. Certificate checks, client onboarding, monitoring and provisioning may all contain small scripts that quietly became essential. Start with the ones that can interrupt service or trigger an automatic change.
What changed in Cloudflare’s DoH JSON?
On 28 July 2026, Cloudflare announced breaking changes to the JSON response’s data field. Several record types moved from generic hexadecimal encoding to readable DNS presentation text. DNSSEC algorithm identifiers changed from names to numbers, and HINFO values gained individual quoting.
| Affected records | Formatting change | What to inspect |
|---|---|---|
| CAA, NAPTR, RP, IPSECKEY, SVCB, HTTPS, TLSA, SSHFP, OPENPGPKEY | Generic hex becomes presentation text | Decoders expecting a hex prefix or fixed layout |
| RRSIG, DS, CDS, DNSKEY, CDNSKEY | Algorithm names become numbers; DS digest types also become numeric | Name matching, lookup tables and validation rules |
| HINFO | Each character-string is quoted separately | Whitespace splitting and quote removal |
The notice warned that old and new formats could appear during rollout. A single successful lookup therefore cannot establish compatibility. Keep examples of both representations wherever your integration needs to accept them.
This concerns the resolver’s JSON output. It does not mean your domain’s DNS records were edited. A tool that only reads A or AAAA records is outside the specific record groups listed above, although its parsing assumptions may still deserve attention.
Find the scripts behind the business process
I would start with a short inventory: what calls the resolver, who owns it, which records it requests, and what happens after the answer arrives. For an agency, include shared utilities deployed across client environments; fixing the central repository does not update every scheduled copy.
From a repository root, this search provides a useful starting point:
rg -n -i 'cloudflare-dns\.com|one\.one\.one\.one|1\.1\.1\.1|application/dns-json|dns-query' .Follow the matches into configuration, helper functions and deployment definitions. Ripgrep normally skips ignored and hidden files, so inspect relevant CI configuration and deployment files separately. Also check scheduled jobs and monitoring systems outside the repository.
Near each lookup, look for awk, cut, regular expressions, Python split(), or unconditional access to the first answer. Using a JSON library or jq solves JSON extraction; the resulting data string still needs interpretation according to its DNS record type.
Rank the findings by consequence. An internal report with a human reviewer can usually wait behind a provisioning job that changes customer settings. Record the owner, proposed repair and failure alert so the review produces an actionable backlog.
Capture the response, then test its meaning
Cloudflare documents JSON queries as GET requests with an Accept: application/dns-json header. This diagnostic example saves headers and a response for inspection; replace the domain with one relevant to your workflow:
curl --fail --silent --show-error --max-time 15 \
--header 'Accept: application/dns-json' \
--dump-header doh-headers.txt \
--output doh-response.json \
'https://cloudflare-dns.com/dns-query?name=example.com&type=CAA'A successful command does not prove that a CAA record exists. Cloudflare’s JSON documentation distinguishes the DNS Status from the answer fields. Your integration must make that distinction too.
Test three layers separately:
- Transport: Check timeouts, HTTP status and response content type.
- DNS response: Decode the JSON, inspect DNS status, and distinguish a nonexistent name, no requested records and a resolver failure.
- Record meaning: Check each answer’s owner and type, parse its data appropriately, and validate the value before passing it downstream.
Store representative old and new responses as test fixtures, alongside the expected interpreted values. Include multiple answers, aliases, missing fields and unsupported representations. Tests should demonstrate that equivalent records produce equivalent decisions, and that unexpected input cannot silently become an empty or guessed value.
For automation that changes configuration, define what happens when interpretation fails. Usually that means stopping the pending change and alerting an owner. A dashboard may instead show an explicit unavailable state. Make the choice deliberate.
Choose a repair that fits the workflow
A small diagnostic tool can reasonably retain JSON with explicit type handling and useful errors. A critical integration benefits from a mature DNS library consuming standardized DNS messages. Cloudflare recommends wire format for critical uses; RFC 8484 defines DNS over HTTPS and the application/dns-message representation.
There is an implementation distinction worth preserving: Cloudflare supports GET and POST for wire format, but GET for JSON. Switching HTTP methods will not repair text parsing. A migration requires constructing and decoding DNS messages, ideally through an established library, rather than merely changing a header.
Keep the parsed records structured throughout the workflow. Converting a library’s result back into display text and splitting it again recreates the same dependency. For monitoring, compare the record values relevant to the check instead of whole response strings, where ordering or TTL changes can create noise.
Deploy with a fallback you can actually use
Repair one representative consumer, validate it, then roll out to similar jobs. When replacing JSON with wire format, compare interpreted results before allowing the replacement to drive changes. Investigate differences with caching and query timing in mind.
Track request failures separately from decoding errors and unsupported records. Reverting application code cannot restore Cloudflare’s former output, so the fallback must itself work with the responses the provider returns.
If ownership is scattered across scripts, suppliers and client environments, I can help map the dependencies, prioritise repairs and coordinate deployment. Get in touch with Greg with the workflow you rely on and, if available, a sample response and the code that reads it.
Related on GrN.dk
- Cloudflare Service Keys: Audit Old Automation Before September 30
- Cloudflare Service Keys Stop in September: Find Every Caller
- Web Browser Automation for Operations and Agency Teams: What to Automate and Which Tool to Use
Need help with this kind of work?
Review your DNS integrations with Greg Get in touch with Greg.
