← Dns / dns / proxy-status

Enforce DNS-only

The enforce DNS-only setting is an account-level break-glass mechanism that allows you to bypass Cloudflare's reverse proxy for all zones in your account in a single action. When enabled, Cloudflare responds to DNS queries with the underlying record content — origin IP addresses for proxied A and AAAA records, and CNAME targets for proxied CNAME records — instead of Cloudflare's anycast IP addresses, effectively setting all proxied DNS records to DNS-only without modifying the records themselves.

This setting is intended for emergency situations only, such as during an outage when you need to quickly route traffic directly to your origins.

• Account-level: Affects all zones in the account simultaneously.
• Non-destructive: Does not modify your DNS records. Disabling the setting restores normal proxy behavior.
• API-only: Available through the API only, not in the Cloudflare dashboard.

Enforce DNS-only works across all zone setup types:

• Full setup: Proxied records in the zone are generally affected, considering a few exceptions.

• Partial (CNAME) setup: Proxied records in the zone are generally affected, considering a few exceptions.

• Secondary zones: If Secondary DNS Overrides is enabled and you have manually set a record's proxy status to proxied, that record will be affected. This also applies to any other A or AAAA records on the same name. Refer to Secondary DNS Overrides for details.

Before relying on enforce DNS-only as part of your incident response plan, you should:

• Verify origin server capacity: Without Cloudflare proxying, your origin servers handle all traffic directly, including traffic that Cloudflare would normally cache or filter. Ensure your infrastructure can sustain this load.
• Review exposed record content: When enforce DNS-only is active, all origin IPs configured in proxied A and AAAA records, as well as the targets of proxied CNAME records, become publicly visible through DNS queries. If your origins rely on IP obscurity for security, plan accordingly.
• Test in advance: Use the API in a staging or test account to confirm that you understand the behavior before you need it in an emergency.

Use the Update DNS Settings endpoint to enable enforce DNS-only for your account:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/dns_settings" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"enforce_dns_only": true
	}'

Once enabled, Cloudflare responds to DNS queries for all proxied records with the underlying record content — your configured origin IP addresses for A and AAAA records, and the configured CNAME target for CNAME records — instead of Cloudflare's anycast IPs.

To restore normal proxy behavior, set enforce_dns_only to false:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/dns_settings" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"enforce_dns_only": false
	}'

After you disable the setting, Cloudflare resumes responding to DNS queries with anycast IP addresses for proxied records and all proxy-based features are restored.

Refer to the sections below in case you use other Cloudflare products that rely on DNS records.

Enforce DNS-only affects the following records:

• Load Balancing: proxied LB records visible on the DNS records table but managed through the Load Balancing configurations.
• Proxied DNS records that match a Worker route.
• Cloudflare for SaaS fallback origin: The proxied DNS record you designate as the fallback origin for custom hostnames.

Enforce DNS-only does not affect the following records:

• R2 custom domains: Read-only proxied records added to the DNS records table when you set up R2 custom domains.

• Spectrum applications: DNS records managed by the Spectrum application.

• Tunnel: CNAME records pointing to a tunnel subdomain. Refer to Tunnel routing or Cloudflare One for details.

• Web3 gateways: Read-only proxied records managed by the Web3 gateway configuration.

• Workers custom domains: Read-only proxied records added to the DNS records table when you set up Workers custom domains.

• Changes take effect immediately at Cloudflare's edge — there is no DNS propagation delay.
• Functionally equivalent to setting all proxied records to DNS-only.

Use the Show DNS Settings endpoint to verify the current value:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/dns_settings" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

• Proxy status - Understand how proxied and DNS-only records behave.
• Batch record changes - Change proxy status for multiple records in bulk within a single zone.