Companies that use Cloudflare Custom Nameservers

What this captures, and what it doesn't

This dataset surfaces companies running on Cloudflare's Custom Nameservers feature, an Enterprise-only capability that lets a customer brand Cloudflare's anycast DNS infrastructure under their own domain instead of the default *.ns.cloudflare.com hostnames.

Standard Cloudflare customers get assigned two randomly-named nameservers such as dana.ns.cloudflare.com and kirk.ns.cloudflare.com. Custom Nameservers customers replace those with vanity hostnames they control - for example ns1.acmecorp.com and ns2.acmecorp.com - while Cloudflare continues serving the queries underneath. The branded nameservers still resolve into Cloudflare's published IP ranges; the only thing that changes is the public face of the DNS chain. Customers use this for white-labeling (B2B SaaS hosting customer domains), brand consistency in vendor audits, and operational flexibility to swap DNS infrastructure underneath without customers needing to update their delegations.

This methodology does not capture:

• Companies on the Free, Pro, or Business plans - those use the default *.ns.cloudflare.com hostnames and appear in our main Cloudflare dataset, not here.
• Companies using other Cloudflare products such as the CDN, Zero Trust, or Workers without Custom Nameservers configured.
• Downstream customers of a SaaS platform that itself uses Custom Nameservers - for example, credit unions whose digital banking is hosted by a vendor like Lumin Digital. The vendor shows up in our dataset; the vendor's customers do not.

Because Custom Nameservers requires an Enterprise contract, this dataset skews toward B2B SaaS platforms white-labeling customer hosting, large enterprises that want branded infrastructure, and agencies running shared DNS for client portfolios. One caveat: Cloudflare also runs Project Galileo and the Athenian Project, which provide free Enterprise-tier service to qualifying nonprofits, journalists, human rights organizations, and election information sites. Custom Nameservers comes with those programs, so a small share of entries in this dataset are organizations on a comped Enterprise tier rather than a paid contract.

How we detect it

The detection runs in three steps against each domain's nameserver records.

First, we pull the NS records for the domain. If any nameserver hostname contains the substring cloudflare, we skip it - that's the default Cloudflare DNS, not a Custom Nameservers deployment. Next, we filter the remaining nameservers to those whose hostnames share a substring with the domain itself. This filters out registrars and DNS hosting platforms (such as Namecheap's *.dnsowl.com nameservers, which are themselves a Cloudflare Enterprise deployment but get applied indiscriminately to every Namecheap customer). Finally, for each remaining nameserver we resolve its A and AAAA records and check whether any of the resulting IPs fall within Cloudflare's published ranges.

A typical match looks like this:

acmecorp.com.        NS    ns1.acmecorp.com
acmecorp.com.        NS    ns2.acmecorp.com

ns1.acmecorp.com.    A     162.159.0.240
ns2.acmecorp.com.    A     162.159.1.239

The branded nameserver hostname on the company's own domain, combined with A records inside Cloudflare's IP space, is unambiguous - Cloudflare is the only provider that issues anycast nameserver IPs in those ranges, and the Custom Nameservers feature is the only mechanism by which a non-Cloudflare-branded hostname ends up there.

We run this check across the most popular domains belonging to roughly 3 million companies, ranked by headcount as reported on their LinkedIn company profiles.