Skip to content

Commit 1ce679f

Browse files
KianNHKianNH
committed
[DNS] Exposed DNS settings in dash
1 parent 58b0ff3 commit 1ce679f

File tree

12 files changed

+296
-43
lines changed

12 files changed

+296
-43
lines changed

‎src/content/docs/dns/additional-options/dns-zone-defaults.mdx‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Zone defaults
4+
sidebar:
5+
order: 3
6+
---
7+
8+
# Configure DNS zone defaults
9+
10+
While there are default values for DNS settings that Cloudflare applies to all new zones, Enterprise accounts have the option to configure their own DNS zone defaults according to their preference.
11+
12+
:::caution
13+
DNS zone defaults are only applied at the moment a new zone is created and will not impact already existing zones. Any of the values specified as default can later be adjusted within each zone, on the respective [**DNS** > **Settings**](https://dash.cloudflare.com/?to=/:account/:zone/dns/settings) or [**DNS** > **Records**](https://dash.cloudflare.com/?to=/:account/:zone/dns/records) page.
14+
:::
15+
16+
## Steps
17+
18+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
19+
2. Go to **Manage Account** > **Configurations** > **DNS Settings**.
20+
3. For **DNS zone defaults**, select **Configure defaults**.
21+
22+
The values you select for the listed settings will be automatically applied to new zones as you add them to your Cloudflare account.
23+
24+
## Available settings
25+
26+
- [Nameserver assignment](/dns/nameservers/nameserver-options/#assignment-method): Select your preferred nameserver type or assignment method that you want Cloudflare to use for your new zones. This setting applies both to primary zones ([full setup](/dns/zone-setups/full-setup/)) and [secondary zones](/dns/zone-setups/zone-transfers/cloudflare-as-secondary/).
27+
28+
For primary zones:
29+
30+
- [Multi-provider DNS](/dns/nameservers/nameserver-options/#multi-provider-dns): Control whether or not Cloudflare will consider `NS` records you add on the zone apex and if zones that contain external nameservers listed in the registrar will be activated.
31+
- [NS record TTL](/dns/nameservers/nameserver-options/#ns-record-ttl): Control how long, in minutes, your nameserver (`NS`) records are cached. The default time-to-live (TTL) is 24 hours. This setting applies both to Cloudflare nameservers and [custom nameservers](/dns/nameservers/custom-nameservers/).
32+
- [SOA record](/dns/manage-dns-records/reference/dns-record-types/#soa): Adjust values for the start of authority (SOA) record that Cloudflare creates for your zone.
33+
34+
For secondary zones:
35+
36+
- [Secondary DNS override](/dns/zone-setups/zone-transfers/cloudflare-as-secondary/proxy-traffic/): Enable the options to use Cloudflare [proxy](/dns/manage-dns-records/reference/proxied-dns-records/) and add `CNAME` records at your zone apex.
37+
38+
Multi-provider DNS does not apply as a setting for secondary zones, as this is already a required behavior for this setup. `SOA` record and the `NS` record TTL are defined on your external DNS provider and only transferred into Cloudflare.

‎src/content/docs/dns/additional-options/reverse-zones.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
pcx_content_type: how-to
33
title: Reverse zones and PTR records
4-
weight: 0
5-
4+
sidebar:
5+
order: 5
66
---
77

88
import { Details, Example } from "~/components"

‎src/content/docs/dns/dnssec/multi-signer-dnssec/setup.mdx‎

Lines changed: 73 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ head:
88
content: Set up multi-signer DNSSEC
99
---
1010

11+
import { Tabs, TabItem } from "~/components"
12+
13+
# Set up multi-signer DNSSEC
14+
1115
This page explains how you can enable [multi-signer DNSSEC](/dns/dnssec/multi-signer-dnssec/) with Cloudflare, using the [model 2](/dns/dnssec/multi-signer-dnssec/about/) as described in [RFC 8901](https://www.rfc-editor.org/rfc/rfc8901.html).
1216

1317
## Before you begin
@@ -20,12 +24,29 @@ Note that:
2024

2125
## 1. Set up Cloudflare zone
2226

23-
:::note
27+
### Cloudflare as Primary (full setup)
28+
29+
If you use Cloudflare as a primary DNS provider, meaning that you manage your DNS records in Cloudflare, do the following:
30+
31+
<Tabs>
32+
<TabItem label="Dashboard">
33+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account and zone.
34+
2. Go to **DNS** > **Settings**.
35+
3. Select **Enable DNSSEC** and **Confirm**.
2436

25-
The following steps also apply if you use [Cloudflare as a secondary DNS provider](/dns/zone-setups/zone-transfers/cloudflare-as-secondary/), with the difference that, in such case, the records in steps 2 and 3 should be transferred from the primary, and step 4 is not necessary.
37+
:::note
38+
For the purpose of this tutorial, you will update your registrar with the DS record later, in [Step 3](/dns/dnssec/multi-signer-dnssec/setup/#3-set-up-registrar).
2639
:::
2740

28-
1. Use the [Edit DNSSEC Status endpoint](/api/operations/dnssec-edit-dnssec-status) to enable DNSSEC and activate multi-signer DNSSEC for your zone. This is done by setting `status` to `active` and `dnssec_multi_signer` to `true`, as in the following example.
41+
4. Also enable **Multi-signer DNSSEC** and **Multi-provider DNS**.
42+
5. Go to **DNS** > **Records** and create the following records at your zone apex (meaning you should use `@` in the record **Name** field):
43+
- A [DNSKEY record](/dns/manage-dns-records/reference/dns-record-types/#ds-and-dnskey) with the zone signing key(s) (ZSKs) of your external provider(s).
44+
- A [NS record](/dns/manage-dns-records/reference/dns-record-types/#ns) with your external provider nameservers.
45+
46+
</TabItem>
47+
<TabItem label="API">
48+
49+
1. Use the [Edit DNSSEC Status endpoint](/api/operations/dnssec-edit-dnssec-status) to enable DNSSEC and activate multi-signer DNSSEC for your zone. Set `status` to `active` and `dnssec_multi_signer` to `true`, as in the following example.
2950

3051
```bash
3152
curl --request PATCH \
@@ -74,27 +95,68 @@ curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
7495
}'
7596
```
7697

77-
4. Enable the usage of the nameservers you added in the previous step by using the API request below. Alternatively, go to [**DNS** > **Settings**](https://dash.cloudflare.com/?to=/:account/:zone/dns/settings) and enable **Multi-provider DNS**.
98+
4. Enable the usage of the nameservers you added in the previous step by using the API request below.
7899

79100
:::caution
101+
This step is required. Without turning on this setting, Cloudflare will ignore any `NS` records created on the zone apex. This means that responses to DNS queries made to the zone apex and requesting `NS` records will only contain Cloudflare nameservers.
102+
:::
80103

81-
This step is required if you are using Cloudflare as a primary DNS provider - without enabling this setting, Cloudflare will ignore any `NS` records created on the zone apex. This means that responses to DNS queries made to the zone apex and requesting `NS` records will only contain Cloudflare nameservers.
104+
```bash
105+
curl --request PATCH \
106+
"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_settings" \
107+
--header "X-Auth-Email: <EMAIL>" \
108+
--header "X-Auth-Key: <API_KEY>" \
109+
--header "Content-Type: application/json" \
110+
--data '{
111+
"multi_provider": true
112+
}'
113+
```
114+
115+
</TabItem>
116+
</Tabs>
117+
118+
### Cloudflare as Secondary
119+
120+
If you use Cloudflare as a secondary DNS provider, do the following:
82121

83-
If you are using [Cloudflare as a secondary DNS provider](/dns/zone-setups/zone-transfers/cloudflare-as-secondary/), this step is not necessary.
122+
<Tabs>
123+
<TabItem label="Dashboard">
84124

125+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account and zone.
126+
2. Go to **DNS** > **Settings**.
127+
3. For **DNSSEC with Secondary DNS** select **Live signing**.
128+
129+
:::note
130+
For the purpose of this tutorial, you will update your registrar with the DS record later, in [Step 3](/dns/dnssec/multi-signer-dnssec/setup/#3-set-up-registrar).
85131
:::
86132

133+
4. Also enable **Multi-signer DNSSEC**.
134+
5. Add the zone signing key(s) (ZSKs) of your external provider(s) to a DNSKEY record at your primary DNS provider. This record should be transferred successfully to Cloudflare.
135+
6. Add your external provider(s) nameservers as NS records on your zone apex at your primary DNS provider. These records should be transferred successfully to Cloudflare.
136+
137+
</TabItem>
138+
<TabItem label="API">
139+
140+
1. Use the [Edit DNSSEC Status endpoint](/api/operations/dnssec-edit-dnssec-status) to enable DNSSEC and activate multi-signer DNSSEC for your zone. Set `status` to `active` and `dnssec_multi_signer` to `true`, as in the following example.
141+
87142
```bash
88-
curl --request PATCH \
89-
"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_settings" \
143+
$ curl --request PATCH 'https://api.cloudflare.com/client/v4/zones/{zone_id}/dnssec' \
90144
--header "X-Auth-Email: <EMAIL>" \
91145
--header "X-Auth-Key: <API_KEY>" \
92146
--header "Content-Type: application/json" \
93147
--data '{
94-
"multi_provider": true
148+
"status": "active",
149+
"dnssec_multi_signer": true
95150
}'
96151
```
97152

153+
2. Add the ZSK(s) of your external provider(s) to a DNSKEY record at your primary DNS provider. This record should be transferred successfully to Cloudflare.
154+
155+
3. Add your external provider(s) nameservers as NS records on your zone apex at your primary DNS provider. These records should be transferred successfully to Cloudflare.
156+
157+
</TabItem>
158+
</Tabs>
159+
98160
## 2. Set up external provider
99161

100162
1. Get Cloudflare's ZSK using either the API or a query from one of the assigned Cloudflare nameservers.
@@ -110,7 +172,7 @@ curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/dnssec/zsk" \
110172
Command line query example:
111173

112174
```sh
113-
dig <ZONE_NAME> dnskey @<CLOUDFLARE_NAMESERVER> +noall +answer | grep 256
175+
$ dig <ZONE_NAME> dnskey @<CLOUDFLARE_NAMESERVER> +noall +answer | grep 256
114176
```
115177

116178
2. Add Cloudflare's ZSK that you fetched in the previous step to the DNSKEY record set of your external provider(s).
@@ -120,4 +182,4 @@ dig <ZONE_NAME> dnskey @<CLOUDFLARE_NAMESERVER> +noall +answer | grep 256
120182

121183
1. Add DS records to your registrar, one for each provider. You can see your Cloudflare DS record on the [dashboard](https://dash.cloudflare.com/?to=/:account/:zone/dns) by going to **DNS** > **Settings** > **DS Record**.
122184

123-
2. Update the nameserver settings at your registrar to include the nameservers of all providers you will be using for your multi-signer DNSSEC setup.
185+
2. Update the nameserver settings at your registrar to include the nameservers of all providers you will be using for your multi-signer DNSSEC setup.

‎src/content/docs/dns/manage-dns-records/reference/dns-record-types.mdx‎

Lines changed: 51 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66

77
---
88

9-
import { Render } from "~/components"
9+
import { Details, Render } from "~/components"
1010

1111
This page provides information about some of the different types of DNS records that you can manage on Cloudflare. For guidance on how to add, edit, or delete DNS records, refer to [Manage DNS records](/dns/manage-dns-records/how-to/create-dns-records/).
1212

@@ -316,11 +316,59 @@ Within Cloudflare, PTR records are used for reverse DNS lookups and should prefe
316316

317317
### SOA
318318

319-
A [start of authority (SOA)](https://www.cloudflare.com/learning/dns/dns-records/dns-soa-record/) record stores information about your domain such as admin email address, when the domain was last updated, and more.
319+
A start of authority (SOA) record stores information about your domain such as admin email address, when the domain was last updated, and more. Refer to [What is a DNS SOA record](https://www.cloudflare.com/learning/dns/dns-records/dns-soa-record/) for an example.
320320

321321
If you are using Cloudflare for your [authoritative DNS](/dns/zone-setups/full-setup/), you do not need to create an SOA record. Cloudflare creates this record automatically when you start using Cloudflare's authoritative nameservers.
322322

323-
<Render file="api-field-definitions" />
323+
If you have an Enterprise account, you also have the option to configure your own [DNS zone defaults](/dns/additional-options/dns-zone-defaults/) and change the SOA record values that Cloudflare will use for all new zones added to your account.
324+
325+
Refer to the following list for information about each SOA record field:
326+
327+
<Details header="SOA record fields">
328+
329+
* **`MNAME`**: The primary nameserver for the zone. Secondary nameservers receive zone updates from the nameserver specified in this field.
330+
* **`RNAME`**: The email address of the administrator responsible for the zone.
331+
332+
The `@` symbol is replaced by the first dot. If an email address contains a dot before `@`, this should be represented as `\.`.
333+
334+
| Email | `RNAME` |
335+
|---------------------------|-------------------------|
336+
|`[email protected]` | `john.example.com` |
337+
|`[email protected]` | `john\.doe.example.com` |
338+
339+
* **`Serial`**: The serial number for the zone. Secondary nameservers initiate zone transfers if this number increases.
340+
* **`Refresh`**: Time (in seconds) after which a secondary nameserver should query the primary for the `SOA` record, to detect zone changes. Only relevant if DNS NOTIFY ([RFC 1996](https://www.rfc-editor.org/rfc/rfc1996.html)) is not configured.
341+
342+
| Default | Minimum | Maximum |
343+
|--------------|------------|----------|
344+
|`10000` | `600` | `86400` |
345+
346+
* **`Retry`**: Time (in seconds) after which a secondary nameserver should retry getting the serial number from the primary nameserver after a failed attempt. Any specified values must not be greater than `Refresh`.
347+
348+
| Default | Minimum | Maximum |
349+
|--------------|------------|----------|
350+
|`2400` | `600` | `3600` |
351+
352+
* **`Expire`**: Time (in seconds) after which a secondary nameserver should stop answering queries for a zone if the primary does not respond. Any specified values must not be smaller than `Refresh`.
353+
354+
| Default | Minimum | Maximum |
355+
|--------------|------------|-----------|
356+
|`604800` | `86400` | `2419200` |
357+
358+
* **`Record TTL`**: The [time to live](/dns/manage-dns-records/reference/ttl/) of the SOA record.
359+
360+
| Default | Minimum | Maximum |
361+
|--------------|------------|----------|
362+
|`3600` | `1800` | `3600` |
363+
364+
* **`Minimum TTL`**: The TTL for caching negative responses. Refer to [RFC 2308](https://www.rfc-editor.org/rfc/rfc2308.html#section-4) for details.
365+
366+
| Default | Minimum | Maximum |
367+
|--------------|------------|----------|
368+
|`1800` | `60` | `86400` |
369+
370+
371+
</Details>
324372

325373
### NS
326374

0 commit comments

Comments
 (0)