Five Rust changes took 100 terabytes off Cloudflare's DNS cache

Serguey Asael Shinder23 September 2026, 17:432 min read

Cloudflare redesigned the in-memory representation of the DNS cache behind its 1.1.1.1 resolver, InfoQ reported on 23 September 2026. The benchmarked per-entry footprint fell 56%, freeing roughly 100 TB of working-set memory across the fleet. The same work on Big Pineapple, Cloudflare's DNS platform, raised cache insertion throughput 43% and cut lookup latency 19%. Big Pineapple holds more than 250 billion cache entries at any moment.

Cloudflare systems engineer Sebastiaan Neuteboom put it on LinkedIn as "It's not every day you get to save 100 terabytes of memory."

The work was five successive changes to the cache representation, in Rust:

• Vec and String replaced with Box<[T]> and Box<str> for data fixed after insertion — 64 bytes saved per entry, more than 15 TB fleetwide on its own;
• answer, authority and additional records combined into one list with compact indices;
• booleans packed into bitflags;
• owner names omitted when they match the queried domain, reconstructed from the cache key;
• record data stored in a contiguous form rather than per-variant allocations.

The hardest part was Rust enums. Cloudflare first boxed the larger variants, but the separate allocations added overhead and hurt memory locality.

The part worth noticing

The single biggest win came from removing capacity, not data. Vec and String carry a capacity field and room to grow; once an entry is written and never resized, that machinery is pure overhead. Sixty-four bytes an entry sounds trivial and is 15 terabytes at this scale — which is the whole lesson about where to look when the row count is enormous and each row is small.

The enum episode is the honest part of the write-up, and a Reddit commenter quoted by InfoQ puts the caveat where it belongs: "A lot of these memory tricks only pay off once you're at Cloudflare's request volume; at a smaller scale the extra indirection from boxing variants can actually hurt cache locality more than it helps."

That is the right way to read the whole list. Throughput went up while memory went down, which is the signal that these were locality wins rather than space-for-time trades — but the sign of that trade flips with scale, and nothing here transfers to a service holding a few million entries.