# Cloudflare DNS: every record of your zones > Source: https://www.allsweb.com/sixpanel/docs/dns > Markdown for agents: https://www.allsweb.com/sixpanel/docs/dns.md > Publisher: AllsWeb (www.allsweb.com) Part of: SixPanel documentation **What this page is for.** One place for the DNS of every domain you keep at Cloudflare: every record, what on this server uses each one, what this server needs that is missing, and a safe way to add, change and delete records. It is the **DNS** tab of the **Cloudflare** page, in the **Panel** menu group. **You need** - At least one Cloudflare account added on the **Cloudflare** page's **Overview** tab (**[Cloudflare](https://www.allsweb.com/sixpanel/docs/cloudflare)**), with an API token that has **DNS → Edit** on the zones you want to see here. Every zone any added account reaches is on this page — the panel's own account and every account a project or a website uses. **The short version.** Pick a zone at the top. **What SixPanel suggests** says whether everything this server needs is there; press **Apply** to write what is missing. Below it, **Records** lists every record of the zone, by type, with a search box; **Add record**, **Edit** and **Delete** change them in your live zone. **Export zone file** downloads the zone, **Import zone file** adds the records of a file after showing you what it would add. --- ## The one rule still holds: every web record is proxied Every A, AAAA and CNAME record this page writes is **proxied** — the orange cloud — exactly as everywhere else in the panel. The form has no proxy switch: the record you add is proxied, a DNS-only record you edit ends proxied, and a record imported from a zone file is imported proxied. A name Cloudflare's proxy cannot carry is refused with the reason, before anything is written: - a name deeper than one label below the zone (`dash.shop.example.com`), which Cloudflare's free certificate does not cover — the refusal names the spelling that fits (`dash-shop.example.com`); - a name your mail is delivered to (an MX record points at it); - a name Cloudflare itself says cannot be proxied. A record that must stay DNS-only for another service (an SSH or a game server, say) is made in Cloudflare's own dashboard; this page shows it, marked **DNS only**, as what it is: an address anyone can read in public DNS. **The one exception is the mail host** — the name mail servers and mail apps connect to (`mail.example.com`). Mail cannot go through Cloudflare's proxy, so that one record is DNS-only by design. It is shown as **DNS only — mail host** and is set up from the **Email** page, never from here. ## Choosing a zone The **Zone** list holds every zone the added Cloudflare accounts reach, each with its account's name; the zones this server uses come first. Beside it: - **Active**, or **Waiting for nameservers** — Cloudflare answers for a zone only once its nameservers are set where the domain was bought. The page then names the two nameservers to set, under **Cloudflare nameservers**, each with a copy button. - The zone's Cloudflare plan. - **Used on this server by** — the panel's own address, the projects and the websites whose addresses are in this zone. The card is called **Cloudflare DNS**: these are the records Cloudflare answers with for the zone. **Read again** asks Cloudflare afresh. The page otherwise keeps a zone's records for a minute, so moving around the page costs Cloudflare nothing. ## What SixPanel suggests SixPanel knows which records this server needs in a zone: the address of the panel, of every 6amMart project and of every website — each an A record for this server, proxied — and whatever its features ask for (when email is set up on this server: its MX, SPF, DKIM and DMARC records and the rest). The scan sets that against what the zone holds, one row per record: | State | What it means | What happens | |---|---|---| | **In place** | The zone holds it, as it should be. | Nothing. | | **Missing** | Nothing holds its place. | **Apply** creates it. | | **Different** | A record SixPanel wrote holds its place with another value — or one of this server's addresses is DNS-only, or an AAAA (or a second A) beside it is. | **Apply** corrects that one record (or puts it behind Cloudflare). | | **Conflict** | A record SixPanel did **not** write holds its place. | Never written by Apply. You decide, with the button on the row. | | **Cannot be written** | SixPanel cannot write it here, and the row says why. | Nothing. | **Apply** on a row writes that one record. **Apply N suggestions** at the top writes every row of the list that SixPanel may write by itself — the rows you see, and no other. Before either, the zone is read again, and each row is written only while it is still what the page showed: the same state, the same action, the same records found. A place somebody changed in between — say a **Missing** row where someone has since made a DNS-only record by hand — is left alone and named in the answer ("changed"); scan again to see it as it is. A name's own row is judged by the record that answers for it: an A record of this server's that is proxied is **In place**, even when Cloudflare lists a DNS-only AAAA for the same name first. That AAAA is a **Different** row of its own — it publishes an address all the same — and **Apply** on it puts that record behind Cloudflare. **What Apply never does.** It never deletes a record. It never writes over a record you made — your SPF record, an address that points at another server, your own MX records. It changes only a record SixPanel wrote itself, and only while that record still holds the value SixPanel wrote: change one of them in Cloudflare and it is yours, and the scan shows it as a conflict instead of putting it back. **The buttons on a conflict:** - **Point it at this server** — one of this server's addresses points at another machine today. This is the same door the Domain & SSL page uses: it asks first, reads the zone again, and changes the record only if it still points where it did. - **Edit that record** — the record holding the place opens in the editor with the value SixPanel suggests filled in. Saving it is your decision. - **Show these records** — several records hold the place; the list below is searched for that name so you can change or delete them by hand. - **Open the Email page** — the row is the mail host, which the Email page sets up. **Records SixPanel wrote that nothing uses now** — for example a key of a feature you removed — are listed under the scan with a **Delete** button. SixPanel never deletes them by itself. ## The records Every record of the zone, ordered by name, 50 to a page (**Per page** offers 100 and 200). The buttons above the list filter by type (**All**, **A**, **AAAA**, **CNAME**, **MX**, **TXT**, **SRV**, **CAA**, **NS**, and **Other** for the rest), each with its count; **Show** narrows the list to the records **used on this server**, the ones **written by SixPanel**, or the **DNS only** ones, each with its count. The search box looks through names, values and notes. Press a column's heading — **Type**, **Name**, **Value**, **Proxy**, **TTL** — to sort by it, and again for the other way round; on a phone the same orders are a list. The small copy button beside a value copies it exactly as a zone file writes it. A zone larger than the panel reads at once says so, and a search then asks Cloudflare itself. Each row shows the record, its value, its proxy state (**Proxied**, **DNS only**, or **DNS only — mail host**), its TTL and what uses it: - **SixPanel** — the panel wrote this record. The scan keeps it correct until you change its value. - A project's, a website's or **This panel**'s name — that address is served by this server. - **this server** beside a value — an A record pointing at this server. - **certificate check** — a `_acme-challenge` record a certificate is issued through. - **Locked** — a test copy's temporary address (AllsWeb's, never changed here), a record Cloudflare manages itself, or a type this page does not write. ## Adding and changing a record **Add record** opens a form for the type you choose; **Edit** opens the same form with the record's values. The name is `@` for the zone itself, or the part before the zone (`www`, `shop`) — the zone is added for you. | Type | What you give | |---|---| | A | an IPv4 address — **Use this server** fills in this server's | | AAAA | an IPv6 address | | CNAME | the name it is an alias of | | MX | the mail server and its priority | | TXT | the value, on one line, without the quotes (SPF, DKIM, a verification code) | | SRV | the service and protocol as the name (`_submission._tcp`), priority, weight, port, target | | CAA | flags, tag (issue, issuewild, iodef) and value (`letsencrypt.org`) | | NS | the nameserver a name below the zone is handed to | | HTTPS, SVCB | priority, target and parameters | The **TTL** is **Auto** or a time from one minute to a day. A proxied record's TTL is always Cloudflare's own, so A, AAAA and CNAME records have none to set. The **note** is yours (up to 100 characters); a record SixPanel wrote keeps its own mark there instead. **An edit is made to the record you saw.** If the record was changed in Cloudflare after the page read it, nothing is written: the page says so and reads the zone again, and you look at it once more. A record's type never changes — delete it and add the new one. The page also refuses what DNS does not allow, with the reason: a CNAME beside other records of its name, the same record twice, an address that is not one, a name that is not a DNS name. ## Deleting a record **Delete** asks first, naming the record and its value. When something on this server uses the record, the question says what stops reaching this server without it, and you type the record's name to go ahead. The record is removed from the live zone at once — export the zone first if you may want it back. ### Deleting several at once Tick the box beside each record — or **All on this page** — and press **Delete selected**. The question names the records (the first twenty, then how many more) and what on this server uses any of them; when something does, you type the zone's name to go ahead. Each record is deleted only while it is still what the page showed: one somebody changed in Cloudflare meanwhile, a test copy's temporary address and a record Cloudflare manages itself are left alone and named in the answer, with why. At most 200 go in one press, and a **Locked** record has no box. **Records SixPanel wrote that nothing uses now** has its own **Delete all** when there is more than one. ## Zone files: export and import **Export zone file** downloads the zone as a BIND zone file — the format every DNS host reads, from Cloudflare's own export. **Import zone file** takes a BIND zone file (choose the file, or paste it). **Check the file** shows, line by line, what it would do — **New**, **Already there**, **Refused** with the reason, **Skipped** (the zone's own SOA and nameservers, which Cloudflare keeps) — and writes nothing. **Import N records** then adds the new ones. Nothing already in the zone is replaced or deleted, and every A, AAAA and CNAME record is imported proxied: a line the file marks DNS-only is refused, and so is an address for a name that mail is delivered to — by an MX record in the zone, or one in the same file, whichever line comes first. A file is at most 512 KB here; a bigger one is imported in Cloudflare's dashboard. ## Who may change records Only the server's owner. A temporary login sees the records and changes nothing. The public demo does not show them at all: a zone's records name your other websites and the real addresses Cloudflare is there to hide. Every change — an added, changed or deleted record, an Apply, an import — is in **Activity**, under Cloudflare, and no Cloudflare token ever reaches the browser. ## Asking Tia Tia reads this page for you: the zones, a zone's records, and what the scan suggests — "is everything in place for shop.example.com?". She can also add, change or delete a record (or several at once), Apply the suggestions or import a zone file, and each of those asks you first, every time, naming what it writes: a delete or a change names the record by its type, name and value and what on this server uses it — the very question this page asks — and a change that renames a record says so ("this renames A example.com → … : it becomes A www.example.com → …"). Apply lists the rows it writes, as the scan showed them. She never sees a Cloudflare token. ## If something looks wrong - **"may not read its DNS records"** — the token can see the zone but lacks **DNS → Edit** for it. Edit the token in Cloudflare; the **Overview** tab shows what each token is missing. - **A record SixPanel suggests keeps showing as a conflict** — something else holds its place. Use the row's button, or change the record by hand. - **"was changed in Cloudflare after this page read it"** — somebody (or another tool) changed it meanwhile. The page has read it again; look, then try once more. - **The page lists no zone** — no added account reaches one. Add the domain to Cloudflare, or give the token access to its zone.