# Ensure DNS records do not expose internal IP addresses

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787215013668-ensure-dns-records-do-not-expose-internal-ip-addresses
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure public DNS records in the zone do not point to private or internal IP addresses, such as RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses. Internal hostnames should be kept in a private DNS system.

**Rationale**

Public DNS records can be looked up by anyone. Records that point to internal addresses reveal the layout of your private network, such as server names and address ranges, which helps attackers plan further attacks. These records also serve no purpose for public visitors, who cannot reach private addresses.

**Impact**

-   Stops disclosing internal network details publicly
    
-   Keeps internal hostnames in private DNS
    
-   Internal tools that relied on public records must use private DNS
    

**Default Value**

By default, Cloudflare does not block records that point to private IP addresses.

**Pre-Requisites**

-   Cloudflare account with Administrator or DNS permissions for the zone
    
-   A private DNS solution for internal hostnames
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Filter by Type A and AAAA, and review the Content of each record.
    
5.  If any record points to a private, loopback, or link-local address, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Move the internal hostname to your private DNS system.
    
5.  Select Edit on the record, select Delete, and confirm.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Select Add record and re-create the record with its previous name and IP address.
    

**Reference**

-   [https://developers.cloudflare.com/dns/manage-dns-records/](https://developers.cloudflare.com/dns/manage-dns-records/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.