Cloudflare Dns

---
name: cloudflare-dns
description: "Expert coverage of Cloudflare DNS: anycast authoritative DNS, proxy vs DNS-only mode, DNSSEC, Foundation DNS, 1.1.1.1 public resolver, DNS Firewall, secondary DNS, CNAME flattening, and API/Terraform management. Use for \"Cloudflare DNS\", \"proxy mode\", \"orange cloud\", \"Foundation DNS\", \"1.1.1.1\", \"Cloudflare DNSSEC\", \"secondary DNS Cloudflare\", \"Cloudflare API\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `dns` skill."
license: MIT
---

# Cloudflare DNS

This skill covers Cloudflare DNS products -- authoritative DNS, Foundation DNS, 1.1.1.1 public resolver, DNS Firewall, and secondary DNS. Areas of expertise include:

- Anycast DNS architecture across 300+ PoPs
- Proxy mode (orange cloud) vs DNS-only mode (grey cloud)
- Zone setup options: full, CNAME (partial), secondary
- One-click DNSSEC with auto-managed keys
- Foundation DNS (Enterprise) with dedicated nameservers and 3-group anycast
- 1.1.1.1 public resolver with DoH, DoT, DoQ, and Families filtering
- DNS Firewall for authoritative nameserver DDoS protection
- Secondary DNS with AXFR/IXFR and TSIG
- Cloudflare API (v4 REST) and Terraform provider

## How to Approach Tasks

1. **Classify** the request:
   - **Zone management** -- Setup type, record management, proxy mode decisions
   - **Security** -- DNSSEC enabling, proxy for origin hiding, DNS Firewall
   - **Performance** -- Anycast, Foundation DNS, TTL optimization
   - **Multi-provider** -- Secondary DNS, multi-signer DNSSEC
   - **IaC** -- Terraform cloudflare provider, API usage

2. **Identify plan tier** -- Free, Pro, Business, Enterprise. Some features (CNAME setup, secondary DNS, Foundation DNS, DNS Firewall) require higher tiers.

3. **Recommend** -- Provide specific configuration via Dashboard, API, or Terraform.

## Core Architecture

### Anycast Network

300+ PoPs worldwide. BGP anycast routes DNS queries to nearest PoP automatically. DDoS mitigation inline at every PoP. No TTL-based failover needed -- routing is at network layer.

### Proxy Mode vs DNS-Only

**Proxied (orange cloud):**
- Traffic flows through Cloudflare's network
- Origin IP hidden; visitors see Cloudflare anycast IPs
- Enables WAF, CDN caching, DDoS protection, Workers, Rate Limiting
- Only for A, AAAA, CNAME records; HTTP/HTTPS only (ports 80, 443 + limited alternates)
- DNS TTL appears as 300 regardless of configured value

**DNS-only (grey cloud):**
- Cloudflare serves authoritative DNS only
- Real IP returned in DNS responses
- No WAF/CDN/DDoS proxy benefit
- Required for MX, TXT, SRV, CAA, NS records and non-HTTP traffic
- Still benefits from Cloudflare's anycast DNS infrastructure

### Zone Setup Options

| Setup | Description | Plan |
|---|---|---|
| Full | Cloudflare is primary authoritative; change NS at registrar | All plans |
| CNAME (partial) | Keep existing DNS; point specific CNAMEs to Cloudflare | Business/Enterprise |
| Secondary | Cloudflare receives zone transfers from your primary | Enterprise |

### CNAME Flattening

Cloudflare automatically resolves CNAME chains at the zone apex and returns A records, solving the "CNAME at apex" problem without requiring Alias records.

## DNSSEC

### One-Click Enabling
1. Enable DNSSEC in Dashboard or API
2. Cloudflare generates and manages KSK/ZSK automatically (ECDSA P-256)
3. Copy DS record and add to registrar (auto-published for Cloudflare Registrar domains)

### Multi-Signer DNSSEC (RFC 8901)
For multi-provider DNS: multiple providers each sign with their own keys. Both providers' DNSKEY records present in zone.

### Foundation DNS Per-Account Keys
Enterprise: dedicated per-account (and per-zone) KSK/ZSK rotation instead of globally shared keys.

## Foundation DNS (Enterprise)

Premium authoritative DNS included in enterprise contracts:

- **Three separate anycast groups** for nameserver IPs (each from geographically distinct DCs)
- **Dedicated nameservers** not shared with other customers
- **Nameservers span multiple TLDs** (.com, .net, .org) for registry resilience
- **Per-account DNSSEC key rotation** for compliance
- **Advanced GraphQL analytics** with 31-day query window, sourceIP dimension, percentile metrics
- **Two-week software soak period** before upgrades reach Foundation DNS nameservers

## 1.1.1.1 Public Resolver

| Service | IPv4 | IPv6 |
|---|---|---|
| Standard | 1.1.1.1, 1.0.0.1 | 2606:4700:4700::1111/1001 |
| Families (malware) | 1.1.1.2, 1.0.0.2 | 2606:4700:4700::1112/1002 |
| Families (malware+adult) | 1.1.1.3, 1.0.0.3 | 2606:4700:4700::1113/1003 |

### Encrypted DNS
- **DoH**: `https://cloudflare-dns.com/dns-query` (GET/POST)
- **DoT**: `1dot1dot1dot1.cloudflare-dns.com` port 853
- **DoQ**: `1.1.1.1` QUIC port 853 (0-RTT, lowest latency)
- **Tor**: Hidden service available

Privacy: no data selling, logs wiped within 24 hours, KPMG-audited.

## DNS Firewall (Enterprise)

Protects authoritative nameservers by proxying DNS queries through Cloudflare:
- DDoS mitigation for authoritative DNS infrastructure
- Rate limiting (per-IP and aggregate)
- Caching with configurable TTL overrides
- Stale record serving if origin unreachable
- No nameserver software changes required

## Secondary DNS (Enterprise)

Cloudflare receives zone transfers from your primary:
- AXFR (full) + IXFR (incremental) support
- TSIG authentication (recommended)
- Internal edge propagation: <5 seconds end-to-end
- Zone transfer completion: ~800ms at P99
- Enables true multi-provider DNS (both sets of NS records at registrar)

## API and IaC

### API (v4 REST)
```bash
# List zones
curl -H "Authorization: Bearer $TOKEN" "https://api.cloudflare.com/client/v4/zones"

# Create DNS record (proxied)
curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
    -H "Authorization: Bearer $TOKEN" \
    -d '{"type":"A","name":"www","content":"1.2.3.4","proxied":true}'

# Enable DNSSEC
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone_id}/dnssec" \
    -H "Authorization: Bearer $TOKEN" \
    -d '{"status":"active"}'
```

### Terraform
```hcl
resource "cloudflare_record" "www" {
  zone_id = data.cloudflare_zone.example.id
  name    = "www"
  value   = "1.2.3.4"
  type    = "A"
  proxied = true
}

resource "cloudflare_zone_dnssec" "example" {
  zone_id = data.cloudflare_zone.example.id
}
```

## Common Pitfalls

1. **Proxying non-HTTP traffic** -- Proxy mode (orange cloud) only works for HTTP/HTTPS on standard ports. MX, SRV, and non-HTTP services must be DNS-only (grey cloud).
2. **Origin IP leaked via non-proxied records** -- If any A/AAAA record exposes origin IP (grey cloud), attackers can bypass Cloudflare proxy. Audit all records.
3. **DNSSEC DS record mismatch** -- After enabling DNSSEC, the DS record must match what Cloudflare displays. Verify with `dig DS example.com` at parent.
4. **Multi-signer DNSSEC cleanup** -- Leaving pre-signed DNSSEC enabled after converting to full zone causes REFUSED responses. Disable pre-signed mode.
5. **TTL on proxied records** -- Configured TTL is ignored for proxied records (always appears as 300). Only DNS-only records respect custom TTL.
6. **Secondary DNS override** -- When using secondary DNS with proxied records, use Secondary DNS Override to control proxy status on transferred records.

## Reference Files

- `references/architecture.md` -- Anycast, proxy vs DNS-only, DNSSEC, Foundation DNS, 1.1.1.1, DNS Firewall, secondary DNS, API/Terraform reference