Cloudflare DNS

Control can manage supported DNS records in an existing Cloudflare account and can use a scoped Cloudflare DNS provider for automatic ACME DNS-01 challenges.

Add the provider

Open DNS → Providers and add a Cloudflare token with the minimum permissions needed for the zones Control should manage: zone read access and DNS write access. Control verifies the credential before marking the provider ready.

Wildcard certificates

From Sites → Certificates → Issue Certificate, choose Automatic DNS · Cloudflare to issue a Let's Encrypt wildcard/apex certificate. The same provider identity is retained for managed renewal. Control uses the provider credential only through the limited DNS/certificate lifecycle; certificate inventory never exposes the token.

Mail DNS publication

Internal Mail can publish its MX, SPF, DKIM and DMARC records directly through a connected Cloudflare provider even when the zone was not previously imported into Control. Control first verifies that public DNS delegates the Mail Domain to Cloudflare, finds the exact authoritative parent zone available to the selected scoped token, synchronises that remote zone into the DNS inventory, and then applies only the missing Mail records. Existing conflicting policy is not overwritten and nameserver delegation is never changed.

Import an existing zone

Use Import Cloudflare Zone, select the provider and enter the exact zone name. Control synchronises supported record types into its managed view. Unsupported Cloudflare record types are left alone rather than being deleted.

Deleting a provider credential is blocked while managed zones still depend on it. A managed certificate that depends on the provider for renewal should be moved to another supported renewal method before the credential is removed.