# Error 1001: DNS resolution error. The origin server's IP address is exposed via DNS records, bypassing Cloudflare proxy.

- **ID:** `policy/cloudflare-origin-ip-exposed-in-dns`
- **Domain:** policy
- **Category:** network_error
- **Error Code:** `1001`
- **Verification:** ai_generated
- **Fix Rate:** 92%

## Root Cause

A DNS record for the domain is set to 'DNS only' (gray cloud) instead of 'Proxied' (orange cloud) in Cloudflare, causing traffic to bypass Cloudflare and expose the origin IP, leading to potential DDoS and security policy violations.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Cloudflare DNS v1 | active | — | — |
| Cloudflare API v4 | active | — | — |

## Workarounds

1. **Change the DNS record from 'DNS only' to 'Proxied' (orange cloud) in Cloudflare dashboard.
Example:
  # Using Cloudflare API:
  curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/RECORD_ID" \
    -H "Authorization: Bearer API_TOKEN" \
    -H "Content-Type: application/json" \
    --data '{"proxied": true}'** (95% success)
   ```
   Change the DNS record from 'DNS only' to 'Proxied' (orange cloud) in Cloudflare dashboard.
Example:
  # Using Cloudflare API:
  curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/RECORD_ID" \
    -H "Authorization: Bearer API_TOKEN" \
    -H "Content-Type: application/json" \
    --data '{"proxied": true}'
   ```
2. **Use Cloudflare's 'Orange Cloud' feature for all HTTP/HTTPS records and ensure no A/AAAA records are set to 'DNS only'. Audit all DNS records regularly.
Example:
  # List all DNS records and check proxied status
  curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \
    -H "Authorization: Bearer API_TOKEN" | jq '.result[] | select(.proxied == false) | {name, type}'** (90% success)
   ```
   Use Cloudflare's 'Orange Cloud' feature for all HTTP/HTTPS records and ensure no A/AAAA records are set to 'DNS only'. Audit all DNS records regularly.
Example:
  # List all DNS records and check proxied status
  curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \
    -H "Authorization: Bearer API_TOKEN" | jq '.result[] | select(.proxied == false) | {name, type}'
   ```
3. **Use Cloudflare's 'Authenticated Origin Pulls' to ensure only Cloudflare IPs can connect to the origin, even if the IP is exposed.
Example:
  # Enable in Cloudflare dashboard: SSL/TLS > Origin Server > Authenticated Origin Pulls > On
  # Then configure your web server to reject non-Cloudflare connections** (75% success)
   ```
   Use Cloudflare's 'Authenticated Origin Pulls' to ensure only Cloudflare IPs can connect to the origin, even if the IP is exposed.
Example:
  # Enable in Cloudflare dashboard: SSL/TLS > Origin Server > Authenticated Origin Pulls > On
  # Then configure your web server to reject non-Cloudflare connections
   ```

## Dead Ends

- **Adding a new proxied A record without removing the old one** — Adding a new A record with the same IP but proxied will not fix the issue if the original unproxied record is still active; both records will resolve, and the unproxied one will expose the IP. (50% fail)
- **Changing the origin server IP** — Changing the origin server IP address might temporarily hide the exposed IP, but if the DNS record remains unproxied, the new IP will also be exposed. (70% fail)
- **Enabling SSL/TLS settings only** — Enabling 'Always Use HTTPS' or other SSL settings does not prevent DNS-level exposure; the record must be proxied. (80% fail)