Skip to content
Merged
Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
2184893
Add Dash steps for internal zone creation
RebeccaTamachiro May 21, 2025
4ed1fe6
Add tabs components and Dash steps to dns-views
RebeccaTamachiro May 21, 2025
d41b450
Revise create a view Dash steps
RebeccaTamachiro May 23, 2025
fb0724b
Add dash instructions for reference zone assignment
RebeccaTamachiro May 23, 2025
3bb666b
Get-started: remove api-only and add Dash tab placeholder
RebeccaTamachiro May 23, 2025
2ca66fd
Fix broken link
RebeccaTamachiro May 23, 2025
cb3afe2
Add partial for zone creation and replace in relevant pages
RebeccaTamachiro May 26, 2025
aa561fb
Add reference zone dash steps and intro to get-started
RebeccaTamachiro May 26, 2025
3ddc1ba
Create and apply partial for view-create-dash
RebeccaTamachiro May 26, 2025
6aaaf90
Overall review and add conditions to view creation partial
RebeccaTamachiro May 26, 2025
49b728d
Overall review and link to iDNS from docs landing page
RebeccaTamachiro May 27, 2025
4364cd0
Specify reference at the bottom of internal zones and view is API-only
RebeccaTamachiro May 28, 2025
b0fd936
Add Internal DNS to /products page
RebeccaTamachiro May 28, 2025
cc353db
Remove 'descriptive' specification for zone name
RebeccaTamachiro Jun 4, 2025
5e036fb
Update get-started to match Gateway resolver UI text
RebeccaTamachiro Jun 4, 2025
023b209
Fix typo
RebeccaTamachiro Jun 4, 2025
ba9fd22
Apply suggestions from code review
RebeccaTamachiro Jun 5, 2025
e60d3b5
Add missing period and implement some page descriptions
RebeccaTamachiro Jun 5, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 25 additions & 3 deletions src/content/docs/dns/internal-dns/dns-views.mdx

This comment was marked as off-topic.

Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar:
label: Views
---

import { Details, Render } from "~/components";
import { Details, Render, Tabs, TabItem } from "~/components";

Internal DNS views are logical groupings of [internal DNS zones](/dns/internal-dns/internal-zones/). As explained in the [architecture overview](/dns/internal-dns/#architecture-overview), DNS views are referenced by [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) to define how a specific query should be resolved.

Expand All @@ -20,16 +20,38 @@ When setting up DNS views, observe the following conditions:

## Create a view

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Render file="internal-dns-view-create-dash"/>

</TabItem>
<TabItem label="API">

Use the [Create Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/create/) endpoint. For each view you create, list all the internal zones that should be grouped under that view.

## Delete a view
</TabItem> </Tabs>

Use the [Delete Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/delete/) endpoint.
## Delete a view

DNS views can be deleted even if they still have internal zones linked to them. The internal DNS zones will continue to exist but will be unlinked once the view is deleted.

It is also possible to delete a DNS view that is being referenced by a Gateway resolver policy. In this case, queries matching the policy will return SERVFAIL.

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** > **Views**.
3. Find the view you want to delete.
4. Select the three dots in the corresponding row and choose *Delete*.
5. In the confirmation dialog, select **Delete** again to proceed.

</TabItem>
<TabItem label="API">

Use the [Delete Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/delete/) endpoint.

</TabItem> </Tabs>

## Other actions

- [Update a DNS view](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/edit/) (`PATCH`)
Expand Down
47 changes: 41 additions & 6 deletions src/content/docs/dns/internal-dns/get-started.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,12 @@ import { TabItem, Tabs, Details, Example, Render } from "~/components";

Follow this guide to get started with Internal DNS.

Although there are some steps that can be achieved on the dashboard, currently the whole process can only be completed via API.

## Before you begin

<Render file="internal-dns-beta-note" />

- Make sure you have an Enterprise account with access to [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) and [Internal DNS](/dns/internal-dns/).
- Consider the different ways in which you can [connect to Gateway resolver](/dns/internal-dns/connectivity/).
- If you are not familiar with how to use Cloudflare API, refer to [Fundamentals](/fundamentals/api/get-started/).
- If you will be using an API token for authentication, make sure you have the following permissions:

<Details header="API token configuration">
Expand All @@ -41,28 +38,64 @@ Although there are some steps that can be achieved on the dashboard, currently t

## 1. Set up your internal DNS zone

<Render file="internal-zone-create" params={{
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Render file="internal-zone-create-dash" params={{
conditional: "get-started-detail"}}
/>

</TabItem> <TabItem label="API">

<Render file="internal-zone-create-api" params={{
conditional: "get-started-detail"}}
/>

</TabItem> </Tabs>

### (Optional) Reference a zone from another zone

1. Use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint to add a reference from an internal zone to another internal zone. In `--data`, specify the `internal_dns` object with the parameter `reference_zone_id`. For details, refer to [reference zones](/dns/internal-dns/internal-zones/reference-zones/).
<Render file="internal-reference-zone-intro" params={{
conditional: "get-started-link"}}
/>

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

1. Go to **Internal DNS** and select a zone.
2. Within the selected zone, go to **Reference zone**.
3. Select **Add reference zone**.
4. Find the zone you want to use as reference and choose **Select** in the respective row.

</TabItem> <TabItem label="API">

1. Use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint to add a reference from an internal zone to another internal zone. In `--json`, specify the `internal_dns` object with the parameter `reference_zone_id`.

<Example>
<Render file="internal-reference-zone-api"/>
</ Example>

</TabItem> </Tabs>

## 2. Link your internal zone to a view

Since the resolver policy will require a [DNS view](/dns/internal-dns/dns-views/), you must have at least one view to be able to route requests to internal zones.

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Render file="internal-dns-view-create-dash" params={{
conditional: "get-started-detail"}}
/>

</TabItem> <TabItem label="API">

1. Use the [Create Internal DNS View](/api/resources/dns/subresources/settings/subresources/account/subresources/views/methods/create/) endpoint. For each view you create, list all the internal zones that should be grouped under that view.

<Details header="DNS view configuration conditions">
<Render file="internal-dns-view-conditions" />
</Details>

</TabItem> </Tabs>
Comment on lines +41 to +96
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If these tab groups are meant to be independent, assign a unique syncKey to each Tabs component to avoid synchronized tab switching across unrelated sections.



## 3. Configure Gateway policies

:::note
Expand Down Expand Up @@ -91,4 +124,6 @@ Use the rule settings object to define `resolve_dns_internally`, specifying `vie
- `none`: Gateway DNS resolver returns the response as-is to the client.
- `public_dns`: In case the response from the internal zone is REFUSED, NXDOMAIN, or a response with a CNAME type, Gateway DNS resolver sends the query to Cloudflare 1.1.1.1 public resolver and tries to resolve the query via public DNS.

</TabItem> </Tabs>
</TabItem> </Tabs>

Once you add the Gateway resolver policy, it will be listed in the respective internal view under **Resolver policies referencing this view**.
2 changes: 1 addition & 1 deletion src/content/docs/dns/internal-dns/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Simplify private network management with Cloudflare DNS for your internal resour

<Plan type="enterprise" />

Manage DNS records that should only be accessible within your private network. Internal DNS [zones](/dns/internal-dns/internal-zones/) and [views](/dns/internal-dns/dns-views/) pair up with [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) so that you can control how a DNS query should be responded to according to the query context, such as its source IP.
Manage DNS records that should only be accessible within your private network. Internal DNS [zones](/dns/internal-dns/internal-zones/) and [views](/dns/internal-dns/dns-views/) pair up with [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) so that you can control how a DNS query should be responded to according to the query context, such as query source IP.

<Render file="internal-dns-beta-note" />

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ sidebar:
order: 4
---

import { Example, Render } from "~/components";
import { Example, Render, Tabs, TabItem } from "~/components";

During an [internal DNS query resolution](/dns/internal-dns/#architecture-overview), if no internal record is found within a matching internal zone, Cloudflare will check if the matching internal zone is referencing another internal zone. Successive references can be followed with a maximum of five references in a chain.
<Render file="internal-reference-zone-intro"/>

:::note
A wildcard record (`*.example.local`) in the matching internal zone will take precedence over an exact match in a referenced zone.
Expand All @@ -22,11 +22,24 @@ A wildcard record (`*.example.local`) in the matching internal zone will take pr

## Set up

To set up a reference zone, use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint. In `--data`, specify the `internal_dns` object with the parameter `reference_zone_id`.
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** and select a zone.
3. Within the selected zone, go to **Reference zone**.
4. Select **Add reference zone**. If your zone already has a reference zone set up, you must first remove it. As explained in the [configuration conditions](#configuration-conditions), each internal zone can only reference one other zone at a time.
5. Find the zone you want to use as reference and choose **Select** in the respective row.

</TabItem>
<TabItem label="API">

Use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint. In `--json`, specify the `internal_dns` object with the parameter `reference_zone_id`.

<Example>
<Render file="internal-reference-zone-api"/>

A third zone (C) could also point to zone B as a reference, but zone A cannot add another zone as a reference while also having zone B configured as its reference zone.

</ Example>
</ Example>

</TabItem> </Tabs>
13 changes: 11 additions & 2 deletions src/content/docs/dns/internal-dns/internal-zones/setup.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ sidebar:
order: 2
---

import { Example, Render } from "~/components";
import { Example, Render, Tabs, TabItem } from "~/components";

Refer to the following sections to learn how to manage your [internal DNS zones](/dns/internal-dns/internal-zones/).

Expand All @@ -17,7 +17,16 @@ When setting up internal zones, observe the following conditions:

## Create an internal zone

<Render file="internal-zone-create" />
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Render file="internal-zone-create-dash" />

</TabItem>
<TabItem label="API">

<Render file="internal-zone-create-api" />

</TabItem> </Tabs>

## Other actions

Expand Down
21 changes: 21 additions & 0 deletions src/content/partials/dns/internal-dns-view-create-dash.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
---
params:
- conditional?
---

import { Details, Render } from "~/components";

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** > **Views**.
3. Select **Create a view**.
4. Give your view a descriptive name.

{ props.conditional === "get-started-detail" && (
<Details header="DNS view configuration conditions">
<Render file="internal-dns-view-conditions" />
</Details>
)
}

5. Select **Manage zones** to add zones to your view. Select the internal zones that should be used to resolve queries sent by Gateway resolver to this view
6. Choose **Save** to confirm.
14 changes: 14 additions & 0 deletions src/content/partials/dns/internal-reference-zone-intro.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
params:
- conditional?
---

During an [internal DNS query resolution](/dns/internal-dns/#architecture-overview), if no internal record is found within a matching internal zone, Cloudflare will check if the matching internal zone is referencing another internal zone. Successive references can be followed with a maximum of five references in a chain.


{ props.conditional === "get-started-link" && (
<p>
For details, refer to <a href="/dns/internal-dns/internal-zones/reference-zones/">reference zones</a>.
</p>
)
}
26 changes: 26 additions & 0 deletions src/content/partials/dns/internal-zone-create-dash.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
---
params:
- conditional?
---

import { Details, Render } from "~/components";

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account.
2. Go to **Internal DNS** and select **Create an internal zone**.
3. Give your internal zone a descriptive name.

{ props.conditional === "get-started-detail" && (
<Details header="Internal zone configuration conditions">
<Render file="internal-zones-conditions" />
</Details>
)
}

4. Add DNS records to your internal zone using your preferred option:
- [Import](/dns/manage-dns-records/how-to/import-and-export/) a formatted BIND file.
- Select **Add a record** and choose **Create** under the record type you want to add. Refer to [DNS record types](/dns/manage-dns-records/reference/dns-record-types/) for details.
5. Repeat this process for each internal zone you wish to add.

:::note
Creating multiple internal DNS records in batch is currently only supported via API.
:::
6 changes: 4 additions & 2 deletions src/content/partials/dns/internal-zones-conditions.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@

- Internal zones can contain the same [DNS record types](/dns/manage-dns-records/reference/dns-record-types/) that Cloudflare supports for public zones.
- An internal zone can have the same name as a public zone in the same account.
- Each internal zone can be linked to multiple [views](/dns/internal-dns/dns-views/).
- Each internal zone can be linked to multiple [views](/dns/internal-dns/dns-views/)[^20].
- There can be several internal zones with the same name in one account. However, two internal zones with the same name cannot be linked to the same view.
- Internal zones are not subject to any top-level domain (TLD) restrictions. This means that an internal zone can be created if its TLD is not registered publicly (for example, `xyz.local`), if it is created on the TLD itself (`local`), or even if on the root (`.`).
- Internal zones are not subject to any top-level domain (TLD) restrictions. This means that an internal zone can be created if its TLD is not registered publicly (for example, `xyz.local`), if it is created on the TLD itself (`local`), or even if on the root (`.`).

[^20]: Logical groupings of internal DNS zones that are referenced by Gateway resolver policies to define how a specific query should be resolved.
Loading