Description

Ensure public DNS records in the zone do not point to private or internal IP addresses, such as RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses. Internal hostnames should be kept in a private DNS system.

Rationale

Public DNS records can be looked up by anyone. Records that point to internal addresses reveal the layout of your private network, such as server names and address ranges, which helps attackers plan further attacks. These records also serve no purpose for public visitors, who cannot reach private addresses.

Impact

  • Stops disclosing internal network details publicly

  • Keeps internal hostnames in private DNS

  • Internal tools that relied on public records must use private DNS

Default Value

By default, Cloudflare does not block records that point to private IP addresses.

Pre-Requisites

  • Cloudflare account with Administrator or DNS permissions for the zone

  • A private DNS solution for internal hostnames

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Filter by Type A and AAAA, and review the Content of each record.

  5. If any record points to a private, loopback, or link-local address, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Move the internal hostname to your private DNS system.

  5. Select Edit on the record, select Delete, and confirm.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Select Add record and re-create the record with its previous name and IP address.

Reference