I have worked in a lot of companies and never have I seen anyone treat a DNS name as security relevant information. If you rely on DNS names not to be known as

I have worked in a lot of companies and never have I seen anyone treat a DNS name as security relevant information. If you rely on DNS names not to be known as a measure of privacy and/or security, you clearly are doing it wrong. As a matter of fact, DNS names supposed to be known, it's their one and only purpose. In addition, if "internal.example.com" is not already resolvable publicly (which would mean that it's known) CF could not guarantee the privacy of that query anyways because their DNS is not part of the root zone, which means they need to forward it to someplace beyond their control, meaning they leak it no matter what.