Cloudflare
Security & compliance
Releases
Code quality
DNS & origin exposure
DNS records that route around your own protection.
Overview
Reads every record in the zone to find the ones that resolve straight to your origin IP, plus the email authentication records that decide whether someone else can send mail as your domain.
What it looks for
- Unproxied A, AAAA, and CNAME records exposing the origin IP
- Wildcard DNS records widening the attack surface
- No DMARC record, leaving the domain spoofable
- Mail-handling domains with no SPF record
Why it matters
One unproxied A record publishes the IP address your WAF and rate limiting are supposed to sit in front of, and an attacker who has it can skip Cloudflare entirely. Without DMARC, anyone can send mail as your domain, which is how invoice fraud usually starts.
Rules in this check
| What it reports | Fix path |
|---|---|
| Unproxied A/AAAA/CNAME records expose the origin IP | Guide |
| Wildcard DNS record widens the attack surface | Guide |
| No DMARC record (domain can be spoofed in email) | Guide |
| Mail domain (has MX) missing an SPF record | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.