Cloudflare DNS: every record of your zones

What this page is for. One place for the DNS of every domain you keep at Cloudflare: every record, what on this server uses each one, what this server needs that is missing, and a safe way to add, change and delete records. It is the DNS tab of the Cloudflare page, in the Panel menu group.

You need

• At least one Cloudflare account added on the Cloudflare page's Overview tab (Cloudflare), with an API token that has DNS → Edit on the zones you want to see here. Every zone any added account reaches is on this page — the panel's own account and every account a project or a website uses.

The short version. Pick a zone at the top. What SixPanel suggests says whether everything this server needs is there; press Apply to write what is missing. Below it, Records lists every record of the zone, by type, with a search box; Add record, Edit and Delete change them in your live zone. Export zone file downloads the zone, Import zone file adds the records of a file after showing you what it would add.

The one rule still holds: every web record is proxied

Every A, AAAA and CNAME record this page writes is proxied — the orange cloud — exactly as everywhere else in the panel. The form has no proxy switch: the record you add is proxied, a DNS-only record you edit ends proxied, and a record imported from a zone file is imported proxied. A name Cloudflare's proxy cannot carry is refused with the reason, before anything is written:

• a name deeper than one label below the zone (dash.shop.example.com), which Cloudflare's free certificate does not cover — the refusal names the spelling that fits (dash-shop.example.com);
• a name your mail is delivered to (an MX record points at it);
• a name Cloudflare itself says cannot be proxied.

A record that must stay DNS-only for another service (an SSH or a game server, say) is made in Cloudflare's own dashboard; this page shows it, marked DNS only, as what it is: an address anyone can read in public DNS.

The one exception is the mail host — the name mail servers and mail apps connect to (mail.example.com). Mail cannot go through Cloudflare's proxy, so that one record is DNS-only by design. It is shown as DNS only — mail host and is set up from the Email page, never from here.

Choosing a zone

The Zone list holds every zone the added Cloudflare accounts reach, each with its account's name; the zones this server uses come first. Beside it:

• Active, or Waiting for nameservers — Cloudflare answers for a zone only once its nameservers are set where the domain was bought. The page then names the two nameservers to set, under Cloudflare nameservers, each with a copy button.
• The zone's Cloudflare plan.
• Used on this server by — the panel's own address, the projects and the websites whose addresses are in this zone.

The card is called Cloudflare DNS: these are the records Cloudflare answers with for the zone. Read again asks Cloudflare afresh. The page otherwise keeps a zone's records for a minute, so moving around the page costs Cloudflare nothing.

What SixPanel suggests

SixPanel knows which records this server needs in a zone: the address of the panel, of every 6amMart project and of every website — each an A record for this server, proxied — and whatever its features ask for (when email is set up on this server: its MX, SPF, DKIM and DMARC records and the rest). The scan sets that against what the zone holds, one row per record:

Apply on a row writes that one record. Apply N suggestions at the top writes every row of the list that SixPanel may write by itself — the rows you see, and no other. Before either, the zone is read again, and each row is written only while it is still what the page showed: the same state, the same action, the same records found. A place somebody changed in between — say a Missing row where someone has since made a DNS-only record by hand — is left alone and named in the answer ("changed"); scan again to see it as it is.

A name's own row is judged by the record that answers for it: an A record of this server's that is proxied is In place, even when Cloudflare lists a DNS-only AAAA for the same name first. That AAAA is a Different row of its own — it publishes an address all the same — and Apply on it puts that record behind Cloudflare.

What Apply never does. It never deletes a record. It never writes over a record you made — your SPF record, an address that points at another server, your own MX records. It changes only a record SixPanel wrote itself, and only while that record still holds the value SixPanel wrote: change one of them in Cloudflare and it is yours, and the scan shows it as a conflict instead of putting it back.

The buttons on a conflict:

• Point it at this server — one of this server's addresses points at another machine today. This is the same door the Domain & SSL page uses: it asks first, reads the zone again, and changes the record only if it still points where it did.
• Edit that record — the record holding the place opens in the editor with the value SixPanel suggests filled in. Saving it is your decision.
• Show these records — several records hold the place; the list below is searched for that name so you can change or delete them by hand.
• Open the Email page — the row is the mail host, which the Email page sets up.

Records SixPanel wrote that nothing uses now — for example a key of a feature you removed — are listed under the scan with a Delete button. SixPanel never deletes them by itself.

The records

Every record of the zone, ordered by name, 50 to a page (Per page offers 100 and 200). The buttons above the list filter by type (All, A, AAAA, CNAME, MX, TXT, SRV, CAA, NS, and Other for the rest), each with its count; Show narrows the list to the records used on this server, the ones written by SixPanel, or the DNS only ones, each with its count. The search box looks through names, values and notes. Press a column's heading — Type, Name, Value, Proxy, TTL — to sort by it, and again for the other way round; on a phone the same orders are a list. The small copy button beside a value copies it exactly as a zone file writes it. A zone larger than the panel reads at once says so, and a search then asks Cloudflare itself.

Each row shows the record, its value, its proxy state (Proxied, DNS only, or DNS only — mail host), its TTL and what uses it:

• SixPanel — the panel wrote this record. The scan keeps it correct until you change its value.
• A project's, a website's or This panel's name — that address is served by this server.
• this server beside a value — an A record pointing at this server.
• certificate check — a _acme-challenge record a certificate is issued through.
• Locked — a test copy's temporary address (AllsWeb's, never changed here), a record Cloudflare manages itself, or a type this page does not write.

Adding and changing a record

Add record opens a form for the type you choose; Edit opens the same form with the record's values. The name is @ for the zone itself, or the part before the zone (www, shop) — the zone is added for you.

The TTL is Auto or a time from one minute to a day. A proxied record's TTL is always Cloudflare's own, so A, AAAA and CNAME records have none to set. The note is yours (up to 100 characters); a record SixPanel wrote keeps its own mark there instead.

An edit is made to the record you saw. If the record was changed in Cloudflare after the page read it, nothing is written: the page says so and reads the zone again, and you look at it once more. A record's type never changes — delete it and add the new one.

The page also refuses what DNS does not allow, with the reason: a CNAME beside other records of its name, the same record twice, an address that is not one, a name that is not a DNS name.

Deleting a record

Delete asks first, naming the record and its value. When something on this server uses the record, the question says what stops reaching this server without it, and you type the record's name to go ahead. The record is removed from the live zone at once — export the zone first if you may want it back.

Deleting several at once

Tick the box beside each record — or All on this page — and press Delete selected. The question names the records (the first twenty, then how many more) and what on this server uses any of them; when something does, you type the zone's name to go ahead. Each record is deleted only while it is still what the page showed: one somebody changed in Cloudflare meanwhile, a test copy's temporary address and a record Cloudflare manages itself are left alone and named in the answer, with why. At most 200 go in one press, and a Locked record has no box. Records SixPanel wrote that nothing uses now has its own Delete all when there is more than one.

Zone files: export and import

Export zone file downloads the zone as a BIND zone file — the format every DNS host reads, from Cloudflare's own export.

Import zone file takes a BIND zone file (choose the file, or paste it). Check the file shows, line by line, what it would do — New, Already there, Refused with the reason, Skipped (the zone's own SOA and nameservers, which Cloudflare keeps) — and writes nothing. Import N records then adds the new ones. Nothing already in the zone is replaced or deleted, and every A, AAAA and CNAME record is imported proxied: a line the file marks DNS-only is refused, and so is an address for a name that mail is delivered to — by an MX record in the zone, or one in the same file, whichever line comes first. A file is at most 512 KB here; a bigger one is imported in Cloudflare's dashboard.

Who may change records

Only the server's owner. A temporary login sees the records and changes nothing. The public demo does not show them at all: a zone's records name your other websites and the real addresses Cloudflare is there to hide. Every change — an added, changed or deleted record, an Apply, an import — is in Activity, under Cloudflare, and no Cloudflare token ever reaches the browser.

Asking Tia

Tia reads this page for you: the zones, a zone's records, and what the scan suggests — "is everything in place for shop.example.com?". She can also add, change or delete a record (or several at once), Apply the suggestions or import a zone file, and each of those asks you first, every time, naming what it writes: a delete or a change names the record by its type, name and value and what on this server uses it — the very question this page asks — and a change that renames a record says so ("this renames A example.com → … : it becomes A www.example.com → …"). Apply lists the rows it writes, as the scan showed them. She never sees a Cloudflare token.

If something looks wrong

• "may not read its DNS records" — the token can see the zone but lacks DNS → Edit for it. Edit the token in Cloudflare; the Overview tab shows what each token is missing.
• A record SixPanel suggests keeps showing as a conflict — something else holds its place. Use the row's button, or change the record by hand.
• "was changed in Cloudflare after this page read it" — somebody (or another tool) changed it meanwhile. The page has read it again; look, then try once more.
• The page lists no zone — no added account reaches one. Add the domain to Cloudflare, or give the token access to its zone.