Add extra DNS check on Cloudflare zone creation to prevent hijacking

Feedback Feature Request Submitting & Feedback
1

Type

Product improvement

Description

Add an extra DNS check before allowing a Cloudflare zone to be created in an account

Benefit

You would prevent bad actors from hijacking your Cloudflare zone. This is what happened to us:

  1. We put graham.ns.cloudflare.com and jessica.ns.cloudflare.com as NS records in our registrar for, let’s say, example.com
  2. A few days had passed
  3. Someone had added example.com as a zone in their Cloudflare account that also uses the “graham” and/or “jessica” nameservers
  4. They had pointed our domain to pornography content

My suggestion: Whenever a Cloudflare zone is created:

  1. A random verification string is generated
  2. That string should be put as a TXT record in the domain registrar (next to the NS records)
  3. Cloudflare should allow the zone to be created only if such a TXT record exists on the domain and matches

This way you prove to Cloudflare that you own the domain, because you’re the only one who has access to the DNS settings of the registrar and can add that TXT record.

2

This situation is already handled. If the nameservers set at the registrar are the same as any at the time of adding the site to Cloudflare, Cloudflare will request a different set of nameservers to be used for the domain.

In other words, adding a site to Cloudflare will always require the nameservers at the registrar to be changed to ensure the person adding the site has control of the domain.

1 Like
3

If that’s the case, then how did someone put A records on our domain that pointed to pornography? Here are the facts:

  • This was our domain and we had Cloudflare nameservers
  • The Cloudflare zone was not in our account
  • There were DNS records not set by us

What are the possible explanations for this?

4

When did this happen? This change was made around 10 months ago…

If you have Cloudflare nameservers, then add the domain to your account you will see you will be asked to set a different pair.

What is the domain?

1 Like
5

In the commit you’ve linked it says:

Each domain’s assigned nameservers may be different than other domains, even if those domains are within the same account.

From what I understand, “may be different” implies that it’s not guaranteed. Maybe we’ve had the bad luck of receiving the same nameservers?

I prefer not to say what the domain is. It’s confidential.

6

It means they may be the same if you add the domain before setting the nameservers at the domain registrar (they usually are but may be different). But they will be different if the “usual” set are already set at the registrar.

If you think this didn’t work as it should, then raise a support ticket as only Cloudflare will be able to look at what happened in your case.

Do you have control of the domain now? If not, as I said, just add the domain again. You’ll get a new set of nameservers and you can set the new ones at the registrar to take control of the domain.

If you don’t want to give the domain name, you can put it in here so I can see it…
https://cf.sjr.org.uk/tools/check

2 Likes
7

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.