DEV Community

Ramer Lacida
Ramer Lacida

Posted on

The Ultimate Checklist for Securing Your DNS Records Across Cloudflare

#dns #devops #security

Introduction

A mis‑configured DNS zone is one of the easiest ways for attackers to hijack traffic, spoof email, or take down an entire service. As a DevOps lead, you’re probably juggling CI pipelines, monitoring dashboards, and on‑call rotations, but DNS security should sit at the top of your checklist. Below is a practical, step‑by‑step guide you can run through during a quarterly audit or a fresh deployment.

1. Harden Your Authoritative Nameservers

1.1 Enable DNSSEC

  • Why it matters – DNSSEC adds a cryptographic signature to each DNS response, preventing cache‑poisoning.
  • How to enable – In Cloudflare, flip the DNSSEC toggle in the DNS tab. For BIND, add the following to your zone file: 
$INCLUDE Kexample.com.+007+12345.key
$INCLUDE Kexample.com.+007+12345.private
example.com. IN DNSKEY 257 3 7 ( \ 
    AwEAAc... (key data) )
Enter fullscreen mode Exit fullscreen mode

1.2 Restrict Zone Transfers

Only allow AXFR/IXFR from your secondary servers:

options {
    allow-transfer { 192.0.2.10; 192.0.2.11; };
    also-notify { 192.0.2.10; 192.0.2.11; };
};
Enter fullscreen mode Exit fullscreen mode

Never expose zone transfers to the public internet – it gives attackers a complete map of your infrastructure.

2. Validate Your Record Types

Record Recommended Action
A / AAAA Use least‑privilege IPs. Prefer CNAMEs to a load‑balancer that can be swapped out.
CNAME Ensure the target is under your control. Avoid pointing to third‑party services that could change without notice.
MX Pair with SPF, DKIM, and DMARC (see section 3).
TXT Keep secrets out of public TXT records. Use them only for verification (e.g., Google Site Verification).
CAA Publish CAA records to restrict which CAs can issue certificates for your domain.

2.1 Example CAA Record 

example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"
Enter fullscreen mode Exit fullscreen mode

This tells any CA that only Let’s Encrypt may issue certs for example.com and sends violation reports to the specified email.

3. Secure Email Delivery

3.1 SPF (Sender Policy Framework) 

example.com. 3600 IN TXT "v=spf1 ip4:203.0.113.0/24 -all"
Enter fullscreen mode Exit fullscreen mode

Only the listed IP range may send mail on behalf of your domain.

3.2 DKIM (DomainKeys Identified Mail)

Generate a key pair and publish the public part:

default._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
Enter fullscreen mode Exit fullscreen mode

Configure your mail server (Postfix, Exim, etc.) to sign outbound mail with the private key.

3.3 DMARC (Domain-based Message Authentication, Reporting & Conformance) 

_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
Enter fullscreen mode Exit fullscreen mode

Reject any message that fails SPF or DKIM and receive aggregate reports.

4. Leverage Cloudflare‑Specific Hardening

  1. Enable “Authenticated Origin Pulls” – Cloudflare will present a client certificate when fetching from your origin, ensuring only Cloudflare can reach it.
  2. Turn on “Automatic HTTPS Rewrites” – Prevent mixed‑content warnings without touching your app code.
  3. Activate “TLS 1.3” and “Full (strict)” – Guarantees end‑to‑end encryption with a valid cert on the origin.
  4. Rate‑limit DNS queries – Use the Rate Limiting page to block abusive query bursts that could be used for DoS.

5. Monitor and Alert on DNS Changes

5.1 Use Cloudflare API for Change Detection 

curl -s -X GET "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/dns_records" \
  -H "Authorization: Bearer <API_TOKEN>" \
  -H "Content-Type: application/json" | jq '.result[] | {name, type, content}'
Enter fullscreen mode Exit fullscreen mode

Schedule this script via a cron job and compare the output to a stored baseline. Any deviation should fire a Slack/PagerDuty alert.

5.2 BIND Logging

Add to named.conf:

logging {
    channel dnssec_log {
        file "/var/log/named/dnssec.log";
        severity info;
    };
    category security { dnssec_log; };
};
Enter fullscreen mode Exit fullscreen mode

Review logs for unexpected key rollovers or failed signature validations.

6. Adopt DNS over HTTPS (DoH) for Internal Services

When your internal microservices query DNS, encrypt the traffic to prevent eavesdropping on a compromised network segment.

# systemd-resolved configuration (Ubuntu 22.04)
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com
DNSOverTLS=yes
FallbackDNS=8.8.8.8
Enter fullscreen mode Exit fullscreen mode

Restart with systemctl restart systemd-resolved.

7. Periodic Audits & Documentation

  • Quarterly – Run the checklist end‑to‑end, documenting any deviations.
  • Version Control – Store zone files in a Git repo, using signed commits to track changes.
  • Runbooks – Keep a short runbook for emergency DNS rollbacks (e.g., a git revert followed by rndc reload).

Conclusion

Securing DNS is a blend of cryptographic safeguards, strict configuration, and vigilant monitoring. By following this checklist you’ll dramatically reduce the attack surface that a simple mis‑typed record can expose. For teams looking for a managed partner that can help audit, implement, and continuously monitor these controls, consider checking out https://lacidaweb.com for a no‑pressure conversation.

Top comments (0)