cloudflare/cloudflared · error

dns-proxy feature is no longer supported

Error message

dns-proxy feature is no longer supported

What it means

The `cloudflared proxy-dns` command was removed in cloudflared 2026.2.0. Run() now unconditionally logs a removal notice and returns this error so scripts relying on the old local DNS proxy fail loudly instead of silently doing nothing. It also links to Cloudflare's recommended DNS-over-HTTPS client alternative.

Source

Thrown at cmd/cloudflared/proxydns/cmd.go:26

	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
	"github.com/cloudflare/cloudflared/logger"
)

const removedMessage = "dns-proxy feature is no longer supported"

func Command() *cli.Command {
	return &cli.Command{
		Name:            "proxy-dns",
		Action:          cliutil.ConfiguredAction(Run),
		Usage:           removedMessage,
		SkipFlagParsing: true,
	}
}

func Run(c *cli.Context) error {
	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
	err := errors.New(removedMessage)
	log.Error().Msg("DNS Proxy is no longer supported since version 2026.2.0 (https://developers.cloudflare.com/changelog/2025-11-11-cloudflared-proxy-dns/). As an alternative consider using https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/dns-over-https-client/")

	return err
}

// Old flags used by the proxy-dns command, only kept to not break any script that might be setting these flags
func ConfigureProxyDNSFlags(shouldHide bool) []cli.Flag {
	return []cli.Flag{
		altsrc.NewBoolFlag(&cli.BoolFlag{
			Name: "proxy-dns",
		}),
		altsrc.NewIntFlag(&cli.IntFlag{
			Name: "proxy-dns-port",
		}),
		altsrc.NewStringFlag(&cli.StringFlag{
			Name: "proxy-dns-address",
		}),
		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Upgrade your setup to use a DNS-over-HTTPS client as recommended by Cloudflare (e.g. cloudflared's successor tooling per the changelog link).
2. Remove `proxy-dns` from startup scripts/systemd units and replace with the alternative DoH client.
3. Pin an older cloudflared version only as a temporary measure while migrating.
4. If you used proxy-dns alongside tunnels, run the tunnel without the removed subcommand — tunnels are unaffected.

Example fix

# before (systemd unit)
ExecStart=/usr/local/bin/cloudflared proxy-dns --port 53 --upstream https://1.1.1.1/dns-query
# after
ExecStart=/usr/local/bin/doh-client --listen 127.0.0.1:53 --upstream https://1.1.1.1/dns-query

if strings.HasPrefix(args[0], "proxy-dns") {
    return errors.New("proxy-dns was removed in 2026.2.0; use a DNS-over-HTTPS client instead")
}

if err := runCloudflared(ctx, "proxy-dns"); err != nil {
    if strings.Contains(err.Error(), "no longer supported") {
        log.Warn("migrating to DoH client")
        return runDohClient(ctx)
    }
    return err
}

When it happens

Trigger: Any invocation of `cloudflared proxy-dns` (with or without old flags like --upstream or --port) on version 2026.2.0 or later.

Common situations: Systemd/init scripts or Docker images that still start `cloudflared proxy-dns`; documentation or dotfiles carrying over the old local DNS resolver setup after upgrading cloudflared.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

• errDeprecatedClassicTunnel
• invalid %s provided: %w
• Invalid hostname provided
• %s is not a valid hostname
• the argument path must be a directory

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/7605b3ad627f831a. Report an issue: GitHub.