DNS records do not expose internal IP addresses

​

What this check verifies

Cloudflare DNS records are assessed for internal IP exposure by checking if A or AAAA records point to private, loopback, or reserved IP addresses which could leak internal network structure.

​

Risk

DNS records exposing internal IP addresses leak sensitive network information.

• Confidentiality: reveals internal network topology and addressing schemes to attackers
• Integrity: provides reconnaissance data for targeted attacks on internal infrastructure
• Availability: internal IPs in public DNS may indicate misconfiguration affecting service routing

​

Recommendation

Remove internal IP addresses from public DNS records.

• Use split-horizon DNS for internal service resolution
• Ensure DNS records only contain publicly routable IP addresses
• Review DNS records after network changes or migrations
• Consider using Cloudflare Access for secure internal service access

​

Remediation

Dashboard steps

1. Log in to the Cloudflare dashboard and select your account and domain
2. Go to DNS > Records
3. Identify A/AAAA records pointing to internal IP addresses
4. Update records to point to public IP addresses or remove if not needed
5. Use split-horizon DNS if internal resolution is required

​

References

• https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/

​

Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = dns_record_no_internal_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Cloudflare checks