Skip to content

SYSTEM Cited by 2 sources

Big Pineapple

Big Pineapple is Cloudflare's in-house recursive DNS resolver. It is the software that powers systems/cloudflare-1-1-1-1-resolver|1.1.1.1, 1.1.1.1 for Families, Gateway DNS, and DNS Firewall — i.e. every public resolver surface Cloudflare operates. Disclosed by name in the 2026-05-06 DNSSEC .de outage post and introduced publicly in the earlier Big Pineapple intro post (not yet ingested on this wiki).

From the 2026-05-06 post:

"For 1.1.1.1 we have our own resolver referred to as Big Pineapple, which also powers 1.1.1.1 for Families, Gateway DNS, DNS Firewall, and more."

Role in Cloudflare's DNS stack

Big Pineapple sits at the recursive-resolver layer — the piece that takes a client's DNS query, walks the DNS hierarchy from root → TLD → authoritative nameserver, validates DNSSEC signatures, and caches answers. It is distinct from Cloudflare's authoritative DNS (which serves records for customer zones) and distinct from the internal origin resolver Cloudflare's CDN uses for customer origin-name resolution — though during the 2026-05-05 .de incident, both the Big-Pineapple-backed 1.1.1.1 and the internal origin resolver received similar NTA-equivalent mitigations.

Implementation details disclosed

From the 2026-05-06 DNSSEC incident:

  • No native NTA mechanism at the time of the incident. Cloudflare had to use "an existing override rule mechanism to mark .de as an insecure zone, which causes all .de queries to be resolved as if they don't have DNSSEC enabled. This is functionality equivalent to an NTA, though it is not formally defined in any RFC." Implied future work: implement a proper RFC-7646 NTA mechanism.
  • Serve-stale is implemented per RFC 8767. During the .de outage this significantly cushioned user impact — NOERROR rates stayed stable for hours despite upstream SERVFAILs, because expired-TTL records were still being served from cache.
  • Extended DNS Error (EDE) code propagation had a latent bug. The trust-chain verifier correctly detected DNSSEC-Bogus signatures and created an EDE 6 code, but the outer resolver layer discarded it and emitted EDE 22 ("No Reachable Authority") instead. The bug was disclosed in the 2026-05-06 post with a commitment to fix: "We're aware that this isn't helpful for 1.1.1.1 users and will be fixing our responses to surface the DNSSEC errors."

Known incidents affecting Big Pineapple (via 1.1.1.1)

Big Pineapple is the software whose bugs + configuration changes show up in the 1.1.1.1 incident record. See systems/cloudflare-1-1-1-1-resolver for the full list. The two most-recent failure modes:

Seen in

  • sources/2026-05-06-cloudflare-when-dnssec-goes-wrong-de-tld-outage — first canonical wiki naming of Big Pineapple as the software behind 1.1.1.1. Disclosed as the substrate that absorbed the .de DNSSEC break via serve-stale + override-rule NTA-equivalent. Self-disclosed the EDE-propagation bug.
  • sources/2026-07-14-cloudflare-dnssec-nta-ede-33 — second wiki instance. Big Pineapple now implements EDE 33 (Negative Trust Anchor) per draft-farrokhi-dnsop-ede-nta, closing the NTA transparency gap. EDE-propagation bug from the .DE incident confirmed fixed (EDE 9 correctly surfaces alongside EDE 33 during the .AL incident).
Last updated · 609 distilled / 1,922 read