Back to Checks
cloudflare

Cloudflare proxy is enabled for applicable DNS records

dns_record_proxied
Service: dnsSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:DNSRecord

Cloudflare DNS records are assessed for proxy configuration by checking if A, AAAA, and CNAME records are proxied through Cloudflare to benefit from DDoS protection, WAF, and caching capabilities.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Unproxied DNS records expose origin server IP addresses directly to the internet.

  • Confidentiality: origin IP exposure enables targeted reconnaissance and attacks
  • Integrity: direct access to origin bypasses WAF and security controls
  • Availability: origin is exposed to DDoS attacks without Cloudflare protection

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks dns_record_proxied

Recommendation

Enable the Cloudflare proxy (orange cloud) for DNS records that should be protected.

  • Proxied records benefit from DDoS protection, WAF, and caching
  • Origin server IP addresses are hidden from public DNS queries
  • Apply defense in depth by combining proxy protection with origin hardening
  • Some record types (MX, TXT) cannot be proxied by design

Remediation

Terraform

# Enable Cloudflare proxy for DNS records
resource "cloudflare_record" "proxied_record" {
  zone_id = "<ZONE_ID>"
  name    = "www"
  content = "192.0.2.1"
  type    = "A"
  proxied = true # Critical: enables DDoS protection, WAF, and caching
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to DNS > Records
3For each A, AAAA, or CNAME record that should be protected
4Click Edit and toggle Proxy status to Proxied (orange cloud)
5Save the changes and verify traffic flows through Cloudflare

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.dns.dns_client import dns_client

PROXYABLE_TYPES = {"A", "AAAA", "CNAME"}


class dns_record_proxied(Check):
    """Ensure that DNS records are proxied through Cloudflare.

    Proxying DNS records through Cloudflare hides the origin server's IP address
    and provides DDoS protection, WAF capabilities, and performance optimizations.
    Non-proxied (DNS-only) records expose the origin IP directly, bypassing
    Cloudflare's security features and making the origin vulnerable to direct
    attacks.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the DNS record proxy status check.

        Iterates through all proxyable DNS records (A, AAAA, CNAME) and verifies
        that they are configured to be proxied through Cloudflare. Non-proxied
        records bypass Cloudflare's security and performance features.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if the
            record is proxied through Cloudflare, or FAIL status if it is
            DNS-only (not proxied).
        """
        findings = []

        for record in dns_client.records:
            # Only check proxyable record types
            if record.type not in PROXYABLE_TYPES:
                continue

            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=record,
            )

            if record.proxied:
                report.status = "PASS"
                report.status_extended = f"DNS record {record.name} ({record.type}) is proxied through Cloudflare."
            else:
                report.status = "FAIL"
                report.status_extended = f"DNS record {record.name} ({record.type}) is not proxied through Cloudflare."
            findings.append(report)

        return findings

References