Check ID: dns_record_proxied
Provider: Cloudflare
Service: dns
Severity: MEDIUM
Categories: internet-exposed
Resource type: DNSRecord

​
What this check verifies

Cloudflare DNS records are assessed for proxy configuration by checking if A, AAAA, and CNAME records are proxied through Cloudflare to benefit from DDoS protection, WAF, and caching capabilities.

​
Risk

Unproxied DNS records expose origin server IP addresses directly to the internet.
  • Confidentiality: origin IP exposure enables targeted reconnaissance and attacks
  • Integrity: direct access to origin bypasses WAF and security controls
  • Availability: origin is exposed to DDoS attacks without Cloudflare protection

​
Recommendation

Enable the Cloudflare proxy (orange cloud) for DNS records that should be protected.
  • Proxied records benefit from DDoS protection, WAF, and caching
  • Origin server IP addresses are hidden from public DNS queries
  • Apply defense in depth by combining proxy protection with origin hardening
  • Some record types (MX, TXT) cannot be proxied by design

​
Remediation

# Enable Cloudflare proxy for DNS records
resource "cloudflare_record" "proxied_record" {
  zone_id = "<ZONE_ID>"
  name    = "www"
  content = "192.0.2.1"
  type    = "A"
  proxied = true # Critical: enables DDoS protection, WAF, and caching
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = dns_record_proxied. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks