Hexa Tiger 
Scale My Publication 
SEO for Public Figures 
Cloudflare says it halved DNS build delay after replacing broad zone rebuilds with a planner that targets only the records a change can affect. The company also reports an 85% reduction in peak memory use, as its Zone Builder handles more incoming events.
The system now receives about 700 DNS record changes per second, nearly three times the roughly 250 reported in 2022, plus about 100 other events. Some zones now contain more than 20 million records, making broad rebuilds increasingly costly.
How Cloudflare Halved DNS Build Delay
A full build reads every record, converts the data for Cloudflare’s authoritative DNS servers and compares the result with Quicksilver, its distributed key-value store. That approach worked for smaller zones, but the largest zones could not fit in memory during a full build.
Cloudflare’s new planner classifies changes into five build types: resources only, resources with metadata, apex with metadata, purge, or full zone. Ordinary A, AAAA, TXT and CNAME changes usually affect specific names. Nameserver and wildcard changes can also affect shared metadata, while Universal SSL settings can affect the zone apex.
The planner uses a narrow build only when it can prove the resulting keys match a full build byte for byte. If an event lacks enough detail, or a change could affect records across the zone, the system keeps the full build. For zones above a fixed record-count threshold, it instead rebuilds the apex, metadata and event-identified names because a full build cannot finish.
That conservative rule matters because several Cloudflare zone objects can briefly share one public domain during customer onboarding or offboarding. Quicksilver stores records separately but keeps shared metadata describing which zone IDs may answer queries. Nameserver and wildcard work updates both records and metadata from a fresh view.
One Scheduler Combines Work Safely
A unified scheduler now combines queued work for the same zone. If an A record change and a wildcard change arrive before a build starts, the scheduler includes both names and the metadata update. Merging adds work; a full-build requirement makes the combined job full, while a purge takes precedence over rebuilds.
The scheduler keeps Kafka messages attached until results are safely written. Kafka advances its committed position only after earlier messages finish, allowing a restart to replay unfinished work. Retries preserve both the DNS work and messages awaiting acknowledgment.
Cloudflare compared a mirror Zone Builder with production using the same events and database state, while the mirror wrote to an environment serving no customer traffic. A comparer sampled 20% of zones for missing, extra or changed keys. After results remained healthy, Cloudflare rolled out the scheduler by zone-name hash.
Memory and Delay Results
Over 24 hours, 92.95% of builds avoided rebuilding a complete zone. Full builds made up 7.04%; Cloudflare says the two metadata build types had previously been full builds, including for large zones. The remaining full builds averaged 0.35 seconds because many affected new zones had few records.
Aggregate working-set memory fell from an average of 49 GiB to 7 GiB, an 86% reduction. Peak memory declined from 79 GiB to 12 GiB, an 85% reduction. The largest p99 DNS build delay spike fell from 14.6 minutes to 1.21 minutes in the side-by-side comparison.
Cloudflare says shorter rebuild intervals on most plans and a smaller event buffer helped cut median DNS build delay from about 7.7 seconds to about 3.3 seconds. That measure ends when data is written to Quicksilver; it does not include distribution across the network.
Full builds remain necessary for first publication, changes that may affect any record, or events that do not identify changes. It plans to move more known event types to targeted builds as it learns their effects. For related coverage of Cloudflare’s engineering, see its event-streaming work, its cache configuration rules and its web application firewall updates. The source for this report is Cloudflare’s DNS build account.
