Back to Checks
cloudflare

DNSSEC is enabled

zone_dnssec_enabled
Service: zoneSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Zone

Cloudflare zones are assessed for DNSSEC configuration by checking if it is enabled to cryptographically sign DNS responses and protect against DNS spoofing and cache poisoning attacks.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without DNSSEC, DNS responses can be spoofed or modified by attackers.

  • Confidentiality: users can be redirected to malicious sites that harvest credentials
  • Integrity: DNS hijacking enables man-in-the-middle attacks and content modification
  • Availability: cache poisoning can cause denial of service by directing traffic to non-existent servers

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_dnssec_enabled

Recommendation

Enable DNSSEC and ensure DS records are properly configured at your domain registrar.

  • DNSSEC provides cryptographic authenticity for DNS responses
  • After enabling in Cloudflare, you must add the DS record at your registrar
  • Use online DNSSEC validators to verify correct configuration

Remediation

Terraform

# Enable DNSSEC for the zone
resource "cloudflare_zone_dnssec" "<example_resource_name>" {
  zone_id = "<ZONE_ID>" # Critical: enables cryptographic signing of DNS responses
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to DNS > Settings
3Scroll to DNSSEC and click Enable DNSSEC
4Copy the DS record details provided by Cloudflare
5Add the DS record at your domain registrar
6Wait for propagation (can take up to 24 hours)

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_dnssec_enabled(Check):
    """Ensure that DNSSEC is enabled for Cloudflare zones.

    DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures
    to DNS records, protecting against DNS spoofing and cache poisoning attacks.
    When enabled, it ensures that DNS responses are authentic and have not been
    tampered with during transit.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the DNSSEC enabled check.

        Iterates through all Cloudflare zones and verifies that DNSSEC status
        is set to 'active'. A zone passes the check if DNSSEC is actively
        protecting its DNS records; otherwise, it fails.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if DNSSEC
            is active, or FAIL status if DNSSEC is not enabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            if zone.dnssec_status == "active":
                report.status = "PASS"
                report.status_extended = f"DNSSEC is enabled for zone {zone.name}."
            else:
                report.status = "FAIL"
                report.status_extended = f"DNSSEC is not enabled for zone {zone.name}."
            findings.append(report)
        return findings

References