diff --git a/resolver/config.go b/resolver/config.go
index b274f119..8e9e8109 100644
--- a/resolver/config.go
+++ b/resolver/config.go
@@ -31,7 +31,7 @@ var (
 
 		// Cloudflare (encrypted DNS, with malware protection)
 		`dot://1.1.1.2:853?verify=cloudflare-dns.com&name=Cloudflare&blockedif=zeroip`,
-		// `dot://1.0.0.2:853?verify=cloudflare-dns.com&name=Cloudflare&blockedif=zeroip`,
+		`dot://1.0.0.2:853?verify=cloudflare-dns.com&name=Cloudflare&blockedif=zeroip`,
 
 		// AdGuard (encrypted DNS, default flavor)
 		// `dot://94.140.14.14:853?verify=dns.adguard.com&name=AdGuard&blockedif=zeroip`,
@@ -107,6 +107,7 @@ The format is: "protocol://ip:port?parameter=value&parameter=value"
 	- "search": specify prioritized domains/TLDs for this resolver (delimited by ",")
 	- "search-only": use this resolver for domains in the "search" parameter only (no value)
 `, `"`, "`"),
+		Sensitive:       true,
 		OptType:         config.OptTypeStringArray,
 		ExpertiseLevel:  config.ExpertiseLevelExpert,
 		ReleaseLevel:    config.ReleaseLevelStable,
@@ -118,6 +119,14 @@ The format is: "protocol://ip:port?parameter=value&parameter=value"
 			config.DisplayOrderAnnotation: cfgOptionNameServersOrder,
 			config.CategoryAnnotation:     "Servers",
 			config.QuickSettingsAnnotation: []config.QuickSetting{
+				{
+					Name:   "Cloudflare (with Malware Filter)",
+					Action: config.QuickReplace,
+					Value: []string{
+						"dot://1.1.1.2:853?verify=cloudflare-dns.com&name=Cloudflare&blockedif=zeroip",
+						"dot://1.0.0.2:853?verify=cloudflare-dns.com&name=Cloudflare&blockedif=zeroip",
+					},
+				},
 				{
 					Name:   "Quad9",
 					Action: config.QuickReplace,
@@ -142,14 +151,6 @@ The format is: "protocol://ip:port?parameter=value&parameter=value"
 						"dot://94.130.106.88:443?verify=dot1.applied-privacy.net&name=AppliedPrivacy",
 					},
 				},
-				{
-					Name:   "Cloudflare (with Malware Filter)",
-					Action: config.QuickReplace,
-					Value: []string{
-						"dot://1.1.1.2:853?verify=cloudflare-dns.com&name=Cloudflare&blockedif=zeroip",
-						"dot://1.0.0.2:853?verify=cloudflare-dns.com&name=Cloudflare&blockedif=zeroip",
-					},
-				},
 			},
 			"self:detail:internalSpecialUseDomains": internalSpecialUseDomains,
 			"self:detail:connectivityDomains":       netenv.ConnectivityDomains,