-
Notifications
You must be signed in to change notification settings - Fork 10.4k
[DNS] Review proxied-dns-records #19311
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
RebeccaTamachiro
wants to merge
16
commits into
production
from
rebecca/dns-revamp-proxied-dns-records
Closed
Changes from 7 commits
Commits
Show all changes
16 commits
Select commit
Hold shift + click to select a range
a8bed18
Move Proxy status higher and add redirect and placeholder pages
RebeccaTamachiro ebf1e20
Rename pages and add cf-configuration as per Abby suggestion
RebeccaTamachiro fbf572c
Remove duplicative unproxied CNAME records note
RebeccaTamachiro c6fa4a1
Remove render component while keeping content in about-proxying
RebeccaTamachiro 0a01634
Move details about IP addresses to proxied-records
RebeccaTamachiro 9d91e18
Adjust order so that more complex cf-config comes last
RebeccaTamachiro 22b9230
Move DNS records detail from Fundamentals to about-proxying
RebeccaTamachiro 43d0345
Review about-proxying improving structure and formatting
RebeccaTamachiro 883ce64
Move detailed example to partials and add back in Fundamentals
RebeccaTamachiro 45b8d01
Delete original page ref and make new folder top-level
RebeccaTamachiro 92920bb
Reorder folders with proxying right below DNS records
RebeccaTamachiro 78b7bde
Recap records def, adjust titles, and better separate explanation fro…
RebeccaTamachiro 69b9dd9
Review and add intro to proxied-records
RebeccaTamachiro 7e66457
Move IP addresses back to main page and add Aegis
RebeccaTamachiro bea80af
Separate allowlist use case from Static IP and BYOIP
RebeccaTamachiro d9946bf
Mention proxying on by dafault as per Abby's suggestion
RebeccaTamachiro File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
src/content/docs/dns/manage-dns-records/proxy-status/about-proxying.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| --- | ||
| pcx_content_type: concept | ||
| title: How proxying works (TBD) | ||
| sidebar: | ||
| order: 2 | ||
| label: About | ||
| --- | ||
|
|
||
| import { Render } from "~/components"; | ||
|
|
||
| The **Proxy status** of a DNS record affects how Cloudflare treats incoming traffic to that record. Cloudflare recommends enabling our proxy for all [A, AAAA, and CNAME](/dns/manage-dns-records/reference/dns-record-types/#ip-address-resolution) records that are used for serving web traffic. | ||
|
|
||
|  | ||
|
|
||
| When you proxy specific DNS records through Cloudflare - specifically A, AAAA, or CNAME records — DNS queries for these will resolve to Cloudflare anycast IPs instead of their original DNS target. This means that all requests intended for proxied hostnames will go to Cloudflare first and then be forwarded to your origin server. | ||
|
|
||
| ```mermaid | ||
| flowchart LR | ||
| accTitle: Connections with Cloudflare | ||
| A[Visitor] <-- Connection --> B[Cloudflare global network] <-- Connection --> C[Origin server] | ||
| ``` | ||
|
|
||
| This behavior allows Cloudflare to [optimize, cache, and protect](/fundamentals/concepts/how-cloudflare-works/) all requests to your application, as well as protect your origin server from [DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/). | ||
|
|
||
| ## DNS-only records | ||
|
|
||
| When an A, AAAA, or CNAME record is **DNS-only** — also known as being gray-clouded — DNS queries for these will resolve to the record's normal IP address. | ||
|
|
||
| In addition to potentially exposing your origin IP addresses to bad actors and [DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/), leaving your records as **DNS-only** means that Cloudflare cannot [optimize, cache, and protect](/fundamentals/concepts/how-cloudflare-works/) requests to your application or provide analytics on those requests. | ||
|
|
||
| ## Example DNS table | ||
|
|
||
| | Type | Name | Content | Proxy status | TTL | Actions | | ||
| | :--: | :----: | :---------: | :----------: | :----: | ------: | | ||
| | `A` | `blog` | `192.0.2.1` | `Proxied` | `Auto` | `Edit` | | ||
| | `A` | `shop` | `192.0.2.2` | `DNS only` | `Auto` | `Edit` | | ||
|
|
||
| In the example DNS table above, there are two DNS records. The record with the name `blog` has the proxy on, while the record named `shop` has the proxy off (that is, **DNS only**). | ||
|
|
||
| ### Proxied DNS record example | ||
|
|
||
| When the browser initiates a HTTP/HTTPS request to `blog.example.com`, a DNS resolver will convert the hostname into an IP address. Since this domain is using Cloudflare as its Authoritative DNS provider, the DNS query will be routed to Cloudflare; and because the proxy is on, Cloudflare will answer with an anycast IP address. Subsequently, the browser initiates a HTTP/HTTPS request back to Cloudflare. When Cloudflare receives this request, it performs a lookup to find the matching domain and account configuration and processes the request accordingly. Cloudflare forwards it to the configured origin server, which is `192.0.2.1`. | ||
|
|
||
| ### DNS only record example | ||
|
|
||
| When the browser initiates a HTTP/HTTPS request to `shop.example.com`, a DNS resolver will convert the hostname into an IP address. Since this domain is using Cloudflare as its Authoritative DNS provider, the DNS query will be routed to Cloudflare; but since the proxy is off (that is, **DNS only**), Cloudflare will answer with `192.0.2.2`. Finally, the browser initiates a HTTP/HTTPS request to the server hosted at `192.0.2.2`. |
9 changes: 9 additions & 0 deletions
9
src/content/docs/dns/manage-dns-records/proxy-status/cloudflare-configuration.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| --- | ||
| pcx_content_type: reference | ||
| title: Products that require proxied records | ||
| sidebar: | ||
| order: 4 | ||
| label: Cloudflare configuration | ||
| --- | ||
|
|
||
| List of other Cloudflare products that depend on records being proxied. |
13 changes: 8 additions & 5 deletions
13
...records/reference/proxied-dns-records.mdx → ...e-dns-records/proxy-status/index copy.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
12 changes: 12 additions & 0 deletions
12
src/content/docs/dns/manage-dns-records/proxy-status/index.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| --- | ||
| pcx_content_type: concept | ||
| title: Proxy status | ||
| sidebar: | ||
| order: 2 | ||
| group: | ||
| hideIndex: true | ||
| --- | ||
|
|
||
| import { DirectoryListing } from "~/components"; | ||
|
|
||
| <DirectoryListing /> |
10 changes: 10 additions & 0 deletions
10
src/content/docs/dns/manage-dns-records/proxy-status/limitations.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| --- | ||
| pcx_content_type: reference | ||
| title: Limitations | ||
| sidebar: | ||
| order: 3 | ||
| --- | ||
|
|
||
| import { Render } from "~/components"; | ||
|
|
||
| <Render file="limitations" product="dns" /> |
56 changes: 56 additions & 0 deletions
56
src/content/docs/dns/manage-dns-records/proxy-status/proxied-records.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| --- | ||
| pcx_content_type: reference | ||
| title: Proxied DNS records | ||
| sidebar: | ||
| order: 2 | ||
| label: Proxied records | ||
| --- | ||
|
|
||
| import { Render } from "~/components"; | ||
|
|
||
| :::caution[TEMP WIP NOTE] | ||
| Not too sure about the name. The idea would be to document any "expected behavior" for proxied records here | ||
|
|
||
| More details of how the DNS record proxy status interacts with other Cloudflare configurations. Besides content below (pulled from previously existing page), things like O2O, BYOIP address maps, etc, could go here. | ||
| ::: | ||
|
|
||
| ## Predefined time to live | ||
|
|
||
|
|
||
| By default, all [proxied records](/dns/manage-dns-records/reference/proxied-dns-records/) have a TTL of **Auto**, which is set to 300 seconds. | ||
|
|
||
| Since only [IP resolution records](/dns/manage-dns-records/reference/dns-record-types/#ip-address-resolution) can be proxied, this setting ensures that queries to your domain name resolve fairly quickly. This setting also means that any changes to proxied `A`, `AAAA`, or `CNAME` records will take place within five minutes or less. | ||
|
|
||
| :::note | ||
|
|
||
|
|
||
| It may take longer than 5 minutes for you to actually experience record changes, as your local DNS cache may take longer to update. | ||
|
|
||
|
|
||
| ::: | ||
|
|
||
| ## Mix proxied and unproxied | ||
|
|
||
| If you have multiple `A/AAAA` records on the same name and at least one of them is proxied, Cloudflare will treat all `A/AAAA` records on this name as being proxied. | ||
|
|
||
| ## Protocol optimization | ||
|
|
||
| For proxied records, if your domain has [HTTP/2 or HTTP/3 enabled](/speed/optimization/protocol/), Cloudflare automatically generates corresponding [HTTPS Service (HTTPS) records](/dns/manage-dns-records/reference/dns-record-types/#svcb-and-https) on the fly. HTTPS records allow you to provide a client with information about how it should connect to a server upfront, without the need of an initial plaintext HTTP connection. | ||
|
|
||
| :::note | ||
| Both HTTP/2 and HTTP/3 configurations also require that you have an SSL/TLS certificate served by Cloudflare. This means that disabling [Universal SSL](/ssl/edge-certificates/universal-ssl/), for example, could impact this behavior. | ||
| ::: | ||
|
|
||
| ## IP addresses | ||
|
|
||
| :::caution[Note to self] | ||
| Consider not going into detail about ingress vs egress here. Maybe a better option would be making note of that while mentioning Address Maps in cloudflare-configuration.mdx | ||
| ::: | ||
|
|
||
|
|
||
| Because requests to proxied hostnames go through Cloudflare before reaching your origin server, all requests will appear to be coming from Cloudflare's IP addresses (and could potentially be blocked or rate limited). If you use proxied records, you may need to adjust your server configuration to [allow Cloudflare IPs](/fundamentals/concepts/cloudflare-ip-addresses/). | ||
|
|
||
| Cloudflare anycast IPs used to proxy traffic on your domain are assigned automatically. These IPs might change at any time for operational reasons. | ||
| If you need to allowlist Cloudflare IPs on your infrastructure or hosting provider, include the full list of [Cloudflare anycast IPs](https://www.cloudflare.com/ips/). | ||
|
|
||
| As an Enterprise customer, you have the option to get [static IPs](/spectrum/about/static-ip/) or [bring your own IPs (BYOIP)](/byoip/). | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Issues:
Fix Explanation:
The capitalization of 'cloudflare' should be corrected to 'Cloudflare' as per the style guide recommendation. This is a straightforward capitalization fix and does not fall under any exceptions such as code references or links.