Skip to content

Commit 94746a5

Browse files
RebeccaTamachirohannes-cfmarciocloudflare
authored
[DNS] Add enforce DNS only (#29353)
* Recreate PR and fix CF Tunnel link * Separate #exceptions from #included and touch-up descriptions * Overall text and linking review * Remove statement about SaaS customer zone * Edit #other-CF-products based on PM comments and testing * Fix broken links * Remove targets from Web3 descr and link to /tunnel/ for item entry * Adjust Tunnel descr and more consistent capitalization * Rewrite paragraphs about Workers features * Re-write and move TTL note higher and improve parallelism throughout * Differentiate A/AAAA from CNAME record contents Co-authored-by: Hannes <105781579+hannes-cf@users.noreply.github.com> * Fix empty bullet and update fallback origin as included * Apply suggestions from code review Co-authored-by: marciocloudflare <83226960+marciocloudflare@users.noreply.github.com> --------- Co-authored-by: Hannes <105781579+hannes-cf@users.noreply.github.com> Co-authored-by: marciocloudflare <83226960+marciocloudflare@users.noreply.github.com>
1 parent 9e6b0f2 commit 94746a5

1 file changed

Lines changed: 99 additions & 0 deletions

File tree

‎src/content/docs/dns/proxy-status/enforce-dns-only.mdx‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
pcx_content_type: troubleshooting
3+
title: Enforce DNS-only
4+
sidebar:
5+
order: 3
6+
label: Enforce DNS-only
7+
---
8+
9+
import { APIRequest } from "~/components";
10+
11+
The enforce DNS-only setting is an account-level break-glass mechanism that allows you to bypass Cloudflare's reverse proxy for all zones in your account in a single action. When enabled, Cloudflare responds to DNS queries with the underlying record content — origin IP addresses for proxied `A` and `AAAA` records, and CNAME targets for proxied `CNAME` records — instead of Cloudflare's anycast IP addresses, effectively setting all [proxied DNS records](/dns/proxy-status/) to DNS-only without modifying the records themselves.
12+
13+
This setting is intended for emergency situations only, such as during an outage when you need to quickly route traffic directly to your origins.
14+
15+
:::caution
16+
Enabling this setting exposes your origin IP addresses and removes all Cloudflare protections — including DDoS mitigation, WAF, caching, and all other proxy-based features — for every zone in your account. Use with extreme caution and only after proper [preparation](#preparation).
17+
:::
18+
19+
## Key characteristics
20+
21+
- Account-level: Affects all zones in the account simultaneously.
22+
- Non-destructive: Does not modify your DNS records. Disabling the setting restores normal proxy behavior.
23+
- API-only: Available through the API only, not in the Cloudflare dashboard.
24+
25+
:::note[Auto TTL for proxied records]
26+
Due to DNS caching by recursive resolvers, the transitions from proxied to DNS-only and back may not be instantaneous. Since all proxied records have a TTL of **Auto**, this value (five minutes by default) determines how long resolvers may continue to serve Cloudflare's anycast IPs or your origin IP addresses.
27+
:::
28+
29+
## Preparation
30+
31+
Before relying on enforce DNS-only as part of your incident response plan, you should:
32+
33+
- Verify origin server capacity: Without Cloudflare proxying, your origin servers handle all traffic directly, including traffic that Cloudflare would normally cache or filter. Ensure your infrastructure can sustain this load.
34+
- Review exposed record content: When enforce DNS-only is active, all origin IPs configured in proxied `A` and `AAAA` records, as well as the targets of proxied `CNAME` records, become publicly visible through DNS queries. If your origins rely on IP obscurity for security, plan accordingly.
35+
- Test in advance: Use the API in a staging or test account to confirm that you understand the behavior before you need it in an emergency.
36+
37+
## Enable enforce DNS-only
38+
39+
Use the [Update DNS Settings](/api/resources/dns/subresources/settings/subresources/account/methods/edit/) endpoint to enable enforce DNS-only for your account:
40+
41+
<APIRequest
42+
path="/accounts/{account_id}/dns_settings"
43+
method="PATCH"
44+
json={{
45+
enforce_dns_only: true,
46+
}}
47+
/>
48+
49+
Once enabled, Cloudflare responds to DNS queries for all proxied records with the underlying record content — your configured origin IP addresses for `A` and `AAAA` records, and the configured CNAME target for `CNAME` records — instead of Cloudflare's anycast IPs.
50+
51+
## Disable enforce DNS-only
52+
53+
To restore normal proxy behavior, set `enforce_dns_only` to `false`:
54+
55+
<APIRequest
56+
path="/accounts/{account_id}/dns_settings"
57+
method="PATCH"
58+
json={{
59+
enforce_dns_only: false,
60+
}}
61+
/>
62+
63+
After you disable the setting, Cloudflare resumes responding to DNS queries with anycast IP addresses for proxied records and all proxy-based features are restored.
64+
65+
## Other Cloudflare products
66+
67+
Refer to the sections below in case you use other Cloudflare products that rely on DNS records.
68+
69+
### Included
70+
71+
Enforce DNS-only affects the following records:
72+
73+
- [Load Balancing](/load-balancing/): proxied LB records visible on the DNS records table but managed through the [Load Balancing configurations](/load-balancing/load-balancers/create-load-balancer/).
74+
- Proxied DNS records that match a [Worker route](/workers/configuration/routing/routes/).
75+
- [Cloudflare for SaaS](/cloudflare-for-platforms/cloudflare-for-saas/) fallback origin: The proxied DNS record you designate as the [fallback origin](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/#1-create-fallback-origin) for custom hostnames.
76+
77+
### Excluded
78+
79+
Enforce DNS-only does not affect the following records:
80+
81+
- [R2](/r2/) custom domains: Read-only proxied records added to the DNS records table when you set up [R2 custom domains](/r2/buckets/public-buckets/#connect-a-bucket-to-a-custom-domain).
82+
- [Spectrum](/spectrum/) applications: DNS records managed by the Spectrum application.
83+
- [Tunnel](/tunnel/): CNAME records pointing to a tunnel subdomain. Refer to [Tunnel routing](/tunnel/routing/#create-a-dns-record) or [Cloudflare One](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns/) for details.
84+
- [Web3 gateways](/web3/): Read-only proxied records managed by the [Web3 gateway configuration](/web3/reference/gateway-dns-records/).
85+
- [Workers](/workers/) custom domains: Read-only proxied records added to the DNS records table when you set up Workers [custom domains](/workers/configuration/routing/custom-domains/).
86+
:::note[Custom domain or route match]
87+
Proxied records that match a Worker [route](/workers/configuration/routing/routes/) are regular DNS records and will be [affected](#included) by the enforce DNS-only setting.
88+
:::
89+
90+
## Check current status
91+
92+
Use the [Show DNS Settings](/api/resources/dns/subresources/settings/subresources/account/methods/get/) endpoint to verify the current value:
93+
94+
<APIRequest path="/accounts/{account_id}/dns_settings" method="GET" />
95+
96+
## Related resources
97+
98+
- [Proxy status](/dns/proxy-status/) - Understand how proxied and DNS-only records behave.
99+
- [Batch record changes](/dns/manage-dns-records/how-to/batch-record-changes/#edit-proxy-status-in-bulk) - Change proxy status for multiple records in bulk within a single zone.

0 commit comments

Comments
 (0)