1001 policy network_error ai_generated true

Error 1001: DNS resolution error. The origin server's IP address is exposed via DNS records, bypassing Cloudflare proxy.

ID: policy/cloudflare-origin-ip-exposed-in-dns

Also available as: JSON · Markdown · 中文

92%Fix Rate

86%Confidence

1Evidence

2023-05-12First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
Cloudflare DNS v1	active	—	—	—
Cloudflare API v4	active	—	—	—

Root Cause

A DNS record for the domain is set to 'DNS only' (gray cloud) instead of 'Proxied' (orange cloud) in Cloudflare, causing traffic to bypass Cloudflare and expose the origin IP, leading to potential DDoS and security policy violations.

generic

中文

域名的 DNS 记录在 Cloudflare 中设置为 '仅 DNS'（灰色云）而不是 '已代理'（橙色云），导致流量绕过 Cloudflare 并暴露源 IP，从而导致潜在的 DDoS 和安全策略违规。

Official Documentation

https://developers.cloudflare.com/dns/manage-dns-records/reference/proxied-dns-records/

Workarounds

95% success Change the DNS record from 'DNS only' to 'Proxied' (orange cloud) in Cloudflare dashboard. Example: # Using Cloudflare API: curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/RECORD_ID" \ -H "Authorization: Bearer API_TOKEN" \ -H "Content-Type: application/json" \ --data '{"proxied": true}'
```
Change the DNS record from 'DNS only' to 'Proxied' (orange cloud) in Cloudflare dashboard.
Example:
  # Using Cloudflare API:
  curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/RECORD_ID" \
    -H "Authorization: Bearer API_TOKEN" \
    -H "Content-Type: application/json" \
    --data '{"proxied": true}'
```
90% success Use Cloudflare's 'Orange Cloud' feature for all HTTP/HTTPS records and ensure no A/AAAA records are set to 'DNS only'. Audit all DNS records regularly. Example: # List all DNS records and check proxied status curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \ -H "Authorization: Bearer API_TOKEN" | jq '.result[] | select(.proxied == false) | {name, type}'
```
Use Cloudflare's 'Orange Cloud' feature for all HTTP/HTTPS records and ensure no A/AAAA records are set to 'DNS only'. Audit all DNS records regularly.
Example:
  # List all DNS records and check proxied status
  curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \
    -H "Authorization: Bearer API_TOKEN" | jq '.result[] | select(.proxied == false) | {name, type}'
```
75% success Use Cloudflare's 'Authenticated Origin Pulls' to ensure only Cloudflare IPs can connect to the origin, even if the IP is exposed. Example: # Enable in Cloudflare dashboard: SSL/TLS > Origin Server > Authenticated Origin Pulls > On # Then configure your web server to reject non-Cloudflare connections
```
Use Cloudflare's 'Authenticated Origin Pulls' to ensure only Cloudflare IPs can connect to the origin, even if the IP is exposed.
Example:
  # Enable in Cloudflare dashboard: SSL/TLS > Origin Server > Authenticated Origin Pulls > On
  # Then configure your web server to reject non-Cloudflare connections
```

中文步骤

在 Cloudflare 仪表板中将 DNS 记录从 '仅 DNS' 更改为 '已代理'（橙色云）。
示例：
  # 使用 Cloudflare API：
  curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/RECORD_ID" \
    -H "Authorization: Bearer API_TOKEN" \
    -H "Content-Type: application/json" \
    --data '{"proxied": true}'

对所有 HTTP/HTTPS 记录使用 Cloudflare 的 '橙色云' 功能，并确保没有 A/AAAA 记录设置为 '仅 DNS'。定期审计所有 DNS 记录。
示例：
  # 列出所有 DNS 记录并检查代理状态
  curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \
    -H "Authorization: Bearer API_TOKEN" | jq '.result[] | select(.proxied == false) | {name, type}'

使用 Cloudflare 的 '已验证源拉取' 功能，确保只有 Cloudflare IP 可以连接到源，即使 IP 暴露也无妨。
示例：
  # 在 Cloudflare 仪表板中启用：SSL/TLS > 源服务器 > 已验证源拉取 > 开启
  # 然后配置您的 Web 服务器拒绝非 Cloudflare 连接

Dead Ends

Common approaches that don't work:

Adding a new proxied A record without removing the old one 50% fail
Adding a new A record with the same IP but proxied will not fix the issue if the original unproxied record is still active; both records will resolve, and the unproxied one will expose the IP.
Changing the origin server IP 70% fail
Changing the origin server IP address might temporarily hide the exposed IP, but if the DNS record remains unproxied, the new IP will also be exposed.
Enabling SSL/TLS settings only 80% fail
Enabling 'Always Use HTTPS' or other SSL settings does not prevent DNS-level exposure; the record must be proxied.