Skip to content
Merged
Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
2184893
Add Dash steps for internal zone creation
RebeccaTamachiro May 21, 2025
4ed1fe6
Add tabs components and Dash steps to dns-views
RebeccaTamachiro May 21, 2025
d41b450
Revise create a view Dash steps
RebeccaTamachiro May 23, 2025
fb0724b
Add dash instructions for reference zone assignment
RebeccaTamachiro May 23, 2025
3bb666b
Get-started: remove api-only and add Dash tab placeholder
RebeccaTamachiro May 23, 2025
2ca66fd
Fix broken link
RebeccaTamachiro May 23, 2025
cb3afe2
Add partial for zone creation and replace in relevant pages
RebeccaTamachiro May 26, 2025
aa561fb
Add reference zone dash steps and intro to get-started
RebeccaTamachiro May 26, 2025
3ddc1ba
Create and apply partial for view-create-dash
RebeccaTamachiro May 26, 2025
6aaaf90
Overall review and add conditions to view creation partial
RebeccaTamachiro May 26, 2025
49b728d
Overall review and link to iDNS from docs landing page
RebeccaTamachiro May 27, 2025
4364cd0
Specify reference at the bottom of internal zones and view is API-only
RebeccaTamachiro May 28, 2025
b0fd936
Add Internal DNS to /products page
RebeccaTamachiro May 28, 2025
cc353db
Remove 'descriptive' specification for zone name
RebeccaTamachiro Jun 4, 2025
5e036fb
Update get-started to match Gateway resolver UI text
RebeccaTamachiro Jun 4, 2025
023b209
Fix typo
RebeccaTamachiro Jun 4, 2025
ba9fd22
Apply suggestions from code review
RebeccaTamachiro Jun 5, 2025
e60d3b5
Add missing period and implement some page descriptions
RebeccaTamachiro Jun 5, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/content/docs/dns/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ Leverage Cloudflare's global network to deliver excellent performance and reliab

Cloudflare DNS is a fast, resilient and easy-to-manage authoritative DNS service. It delivers excellent performance and reliability to your domain while also protecting your business from [DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/) and [route leaks and hijacking](https://www.cloudflare.com/learning/security/glossary/bgp-hijacking/). To know where to begin, refer to [Get started](/dns/get-started/).

Enterprise customers can also use Cloudflare DNS for their private network with [Intenal DNS (Beta)](/dns/internal-dns/)

***

## Features
Expand Down
30 changes: 26 additions & 4 deletions src/content/docs/dns/internal-dns/dns-views.mdx

This comment was marked as off-topic.

Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar:
label: Views
---

import { Details, Render } from "~/components";
import { Details, Render, Tabs, TabItem } from "~/components";

Internal DNS views are logical groupings of [internal DNS zones](/dns/internal-dns/internal-zones/). As explained in the [architecture overview](/dns/internal-dns/#architecture-overview), DNS views are referenced by [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) to define how a specific query should be resolved.

Expand All @@ -20,17 +20,39 @@ When setting up DNS views, observe the following conditions:

## Create a view

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Render file="internal-dns-view-create-dash"/>

</TabItem>
<TabItem label="API">

Use the [Create Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/create/) endpoint. For each view you create, list all the internal zones that should be grouped under that view.

## Delete a view
</TabItem> </Tabs>

Use the [Delete Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/delete/) endpoint.
## Delete a view

DNS views can be deleted even if they still have internal zones linked to them. The internal DNS zones will continue to exist but will be unlinked once the view is deleted.

It is also possible to delete a DNS view that is being referenced by a Gateway resolver policy. In this case, queries matching the policy will return SERVFAIL.

## Other actions
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** > **Views**.
3. Find the view you want to delete.
4. Select the three dots in the corresponding row and choose *Delete*.
5. In the confirmation dialog, select **Delete** again to proceed.

</TabItem>
<TabItem label="API">

Use the [Delete Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/delete/) endpoint.

</TabItem> </Tabs>

## Other API actions

- [Update a DNS view](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/edit/) (`PATCH`)
- [Get view details](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/get/) (`GET`)
Expand Down
49 changes: 42 additions & 7 deletions src/content/docs/dns/internal-dns/get-started.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,12 @@ import { TabItem, Tabs, Details, Example, Render } from "~/components";

Follow this guide to get started with Internal DNS.

Although there are some steps that can be achieved on the dashboard, currently the whole process can only be completed via API.

## Before you begin

<Render file="internal-dns-beta-note" />

- Make sure you have an Enterprise account with access to [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) and [Internal DNS](/dns/internal-dns/).
- Consider the different ways in which you can [connect to Gateway resolver](/dns/internal-dns/connectivity/).
- If you are not familiar with how to use Cloudflare API, refer to [Fundamentals](/fundamentals/api/get-started/).
- If you will be using an API token for authentication, make sure you have the following permissions:

<Details header="API token configuration">
Expand All @@ -41,28 +38,64 @@ Although there are some steps that can be achieved on the dashboard, currently t

## 1. Set up your internal DNS zone

<Render file="internal-zone-create" params={{
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Render file="internal-zone-create-dash" params={{
conditional: "get-started-detail"}}
/>

</TabItem> <TabItem label="API">

<Render file="internal-zone-create-api" params={{
conditional: "get-started-detail"}}
/>

</TabItem> </Tabs>

### (Optional) Reference a zone from another zone

1. Use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint to add a reference from an internal zone to another internal zone. In `--data`, specify the `internal_dns` object with the parameter `reference_zone_id`. For details, refer to [reference zones](/dns/internal-dns/internal-zones/reference-zones/).
<Render file="internal-reference-zone-intro" params={{
conditional: "get-started-link"}}
/>

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

1. Go to **Internal DNS** and select a zone.
2. Within the selected zone, go to **Reference zone**.
3. Select **Add reference zone**.
4. Find the zone you want to use as reference and choose **Select** in the respective row.

</TabItem> <TabItem label="API">

1. Use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint to add a reference from an internal zone to another internal zone. In `--json`, specify the `internal_dns` object with the parameter `reference_zone_id`.

<Example>
<Render file="internal-reference-zone-api"/>
</ Example>

</TabItem> </Tabs>

## 2. Link your internal zone to a view

Since the resolver policy will require a [DNS view](/dns/internal-dns/dns-views/), you must have at least one view to be able to route requests to internal zones.

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Render file="internal-dns-view-create-dash" params={{
conditional: "get-started-detail"}}
/>

</TabItem> <TabItem label="API">

1. Use the [Create Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/create/) endpoint. For each view you create, list all the internal zones that should be grouped under that view.

<Details header="DNS view configuration conditions">
<Render file="internal-dns-view-conditions" />
</Details>

</TabItem> </Tabs>
Comment on lines +41 to +96
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If these tab groups are meant to be independent, assign a unique syncKey to each Tabs component to avoid synchronized tab switching across unrelated sections.



## 3. Configure Gateway policies

:::note
Expand All @@ -76,7 +109,7 @@ Besides selecting an internal DNS view when setting up your resolver policies, y
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Resolver policies**.
2. Select **Add a policy** and enter a name and description.
3. Create an expression for the traffic you wish to route. For guidance about selectors, operators, and values, refer to [Gateway](/cloudflare-one/policies/gateway/resolver-policies/#selectors).
4. Select **Use DNS view**. In the dropdown, choose the view that queries matching the expression should be sent to.
4. Select **Use Internal DNS**. In the dropdown, choose the view that queries matching the expression should be sent to.
5. (Optional) Adjust the option to **fallback through public DNS** according to your use case.
- Off: Gateway DNS resolver returns the response as-is to the client.
- On: In case the response from the internal zone is REFUSED, NXDOMAIN, or a response with a CNAME type, Gateway DNS resolver sends the query to Cloudflare 1.1.1.1 public resolver and tries to resolve the query via public DNS.
Expand All @@ -91,4 +124,6 @@ Use the rule settings object to define `resolve_dns_internally`, specifying `vie
- `none`: Gateway DNS resolver returns the response as-is to the client.
- `public_dns`: In case the response from the internal zone is REFUSED, NXDOMAIN, or a response with a CNAME type, Gateway DNS resolver sends the query to Cloudflare 1.1.1.1 public resolver and tries to resolve the query via public DNS.

</TabItem> </Tabs>
</TabItem> </Tabs>

Once you add the Gateway resolver policy, it will be listed in the respective internal view under **Resolver policies referencing this view**.
2 changes: 1 addition & 1 deletion src/content/docs/dns/internal-dns/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Simplify private network management with Cloudflare DNS for your internal resour

<Plan type="enterprise" />

Manage DNS records that should only be accessible within your private network. Internal DNS [zones](/dns/internal-dns/internal-zones/) and [views](/dns/internal-dns/dns-views/) pair up with [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) so that you can control how a DNS query should be responded to according to the query context, such as its source IP.
Manage DNS records that should only be accessible within your private network. Internal DNS [zones](/dns/internal-dns/internal-zones/) and [views](/dns/internal-dns/dns-views/) pair up with [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) so that you can control how a DNS query should be responded to according to query context, such as query source IP.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The revised sentence removes 'the' and 'its', making the sentence less clear. Consider reverting to: 'according to the query context, such as its source IP.' for improved readability.


<Render file="internal-dns-beta-note" />

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ Refer to [Manage DNS records](/dns/manage-dns-records/how-to/create-dns-records/

## CNAME flattening in Internal DNS

With CNAME flattening, Cloudflare finds the final target content that a CNAME points to and then returns this content instead of a CNAME record. With Internal DNS, CNAME flattening is applied by default and cannot be turned off.
With [CNAME flattening](/dns/cname-flattening/), Cloudflare finds the final target content that a CNAME points to and then returns this content instead of a CNAME record. With Internal DNS, CNAME flattening is applied by default and cannot be turned off.

Cloudflare will try to flatten the CNAME record considering both the specified [DNS view](/dns/internal-dns/dns-views/) and any existing [reference zones](/dns/internal-dns/internal-zones/reference-zones/). If the reference zone then has another CNAME, the record will again be considered from the perspective of the original view.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@ sidebar:
order: 4
---

import { Example, Render } from "~/components";
import { Example, Render, Tabs, TabItem } from "~/components";

During an [internal DNS query resolution](/dns/internal-dns/#architecture-overview), if no internal record is found within a matching internal zone, Cloudflare will check if the matching internal zone is referencing another internal zone. Successive references can be followed with a maximum of five references in a chain.
<Render file="internal-reference-zone-intro"/>

:::note
A wildcard record (`*.example.local`) in the matching internal zone will take precedence over an exact match in a referenced zone.
A wildcard record (`*.example.local`) in the matching internal zone will take precedence over an exact match in a reference zone.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider standardizing the use of 'reference zone' vs 'referenced zone' throughout the document for consistency and clarity.

:::

## Configuration conditions
Expand All @@ -22,11 +22,24 @@ A wildcard record (`*.example.local`) in the matching internal zone will take pr

## Set up

To set up a reference zone, use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint. In `--data`, specify the `internal_dns` object with the parameter `reference_zone_id`.
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** and select a zone.
3. Within the selected zone, go to **Reference zone**.
4. Select **Add reference zone**. If your zone already has a reference zone set up, you must first remove it. As explained in the [configuration conditions](#configuration-conditions), each internal zone can only reference one other zone at a time.
5. Find the zone you want to use as reference and choose **Select** in the respective row.

</TabItem>
<TabItem label="API">

Use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint. In `--json`, specify the `internal_dns` object with the parameter `reference_zone_id`.

<Example>
<Render file="internal-reference-zone-api"/>

A third zone (C) could also point to zone B as a reference, but zone A cannot add another zone as a reference while also having zone B configured as its reference zone.

</ Example>
</ Example>

</TabItem> </Tabs>
15 changes: 12 additions & 3 deletions src/content/docs/dns/internal-dns/internal-zones/setup.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ sidebar:
order: 2
---

import { Example, Render } from "~/components";
import { Example, Render, Tabs, TabItem } from "~/components";

Refer to the following sections to learn how to manage your [internal DNS zones](/dns/internal-dns/internal-zones/).

Expand All @@ -17,9 +17,18 @@ When setting up internal zones, observe the following conditions:

## Create an internal zone

<Render file="internal-zone-create" />
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

## Other actions
<Render file="internal-zone-create-dash" />

</TabItem>
<TabItem label="API">

<Render file="internal-zone-create-api" />

</TabItem> </Tabs>

## Other API actions

The API endpoints to manage internal zones are the same as for managing public zones. The main difference is that the zone type must be set to `internal`. Refer to the API documentation below for details:

Expand Down
21 changes: 21 additions & 0 deletions src/content/partials/dns/internal-dns-view-create-dash.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
---
params:
- conditional?
---

import { Details, Render } from "~/components";

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** > **Views**.
3. Select **Create a view**.
4. Give your view a descriptive name.

{ props.conditional === "get-started-detail" && (
<Details header="DNS view configuration conditions">
<Render file="internal-dns-view-conditions" />
</Details>
)
}

5. Select **Manage zones** to add zones to your view. Select the internal zones that should be used to resolve queries sent by Gateway resolver to this view
6. Choose **Save** to confirm.
14 changes: 14 additions & 0 deletions src/content/partials/dns/internal-reference-zone-intro.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
params:
- conditional?
---

During an [internal DNS query resolution](/dns/internal-dns/#architecture-overview), if no internal record is found within a matching internal zone, Cloudflare will check if the matching internal zone is referencing another internal zone. Successive references can be followed with a maximum of five references in a chain.


{ props.conditional === "get-started-link" && (
<p>
For details, refer to <a href="/dns/internal-dns/internal-zones/reference-zones/">reference zones</a>.
</p>
)
}
26 changes: 26 additions & 0 deletions src/content/partials/dns/internal-zone-create-dash.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
---
params:
- conditional?
---

import { Details, Render } from "~/components";

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** and select **Create an internal zone**.
3. Give your internal zone a name.

{ props.conditional === "get-started-detail" && (
<Details header="Internal zone configuration conditions">
<Render file="internal-zones-conditions" />
</Details>
)
}

4. Add DNS records to your internal zone using your preferred option:
- [Import](/dns/manage-dns-records/how-to/import-and-export/) a formatted BIND file.
- Select **Add a record** and choose **Create** under the record type you want to add. Refer to [DNS record types](/dns/manage-dns-records/reference/dns-record-types/) for details.
5. Repeat this process for each internal zone you wish to add.

:::note
Creating multiple internal DNS records in batch is currently only supported via API.
:::
6 changes: 4 additions & 2 deletions src/content/partials/dns/internal-zones-conditions.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@

- Internal zones can contain the same [DNS record types](/dns/manage-dns-records/reference/dns-record-types/) that Cloudflare supports for public zones.
- An internal zone can have the same name as a public zone in the same account.
- Each internal zone can be linked to multiple [views](/dns/internal-dns/dns-views/).
- Each internal zone can be linked to multiple [views](/dns/internal-dns/dns-views/)[^20].
- There can be several internal zones with the same name in one account. However, two internal zones with the same name cannot be linked to the same view.
- Internal zones are not subject to any top-level domain (TLD) restrictions. This means that an internal zone can be created if its TLD is not registered publicly (for example, `xyz.local`), if it is created on the TLD itself (`local`), or even if on the root (`.`).
- Internal zones are not subject to any top-level domain (TLD) restrictions. This means that an internal zone can be created if its TLD is not registered publicly (for example, `xyz.local`), if it is created on the TLD itself (`local`), or even if on the root (`.`).

[^20]: Logical groupings of internal DNS zones that are referenced by Gateway resolver policies to define how a specific query should be resolved.
9 changes: 9 additions & 0 deletions src/content/products/internal-dns.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
name: Internal DNS

product:
title: Internal DNS
group: Application performance
url: /dns/internal-dns/

meta:
description: Use Cloudflare DNS for your internal resources.
Loading