Unproxied A/AAAA/CNAME records expose the origin IP
Part of the DNS & origin exposure check · fix arrives as a guide
What it is
A, AAAA, or CNAME records in the zone are set to DNS-only rather than proxied, so they resolve directly to your origin IP.
Why it matters
That IP is what your WAF, rate limiting, and DDoS protection sit in front of. Once it is published in DNS, an attacker can address the origin directly and skip all of it — the protection remains configured and simply is not on the path.
How to fix it
Switch the records to proxied. For records that genuinely cannot be proxied, such as mail, use a hostname that does not resolve to the web origin, and firewall the origin to accept traffic only from Cloudflare's ranges.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.