403
Our root and www A records were changed to Cloudflare IP addresses
Changed the A records back to our origin server. I can’t find anything in the audit log indicating a change to the DNS records, and the IP addresses appear to belong to Cloudflare…
DNS records
We’ve seen this happen if a domain was added to a second cf account and the scan picket up the cf IP addresses.
Did that correct the issue?
Changing the IP back to our origin server corrected the issue of our site not being available, but not the issue of the DNS records being changed without consent. Are you saying someone else added our domain to their Cloudflare account? How can we keep this from happening? The other DNS records were left unchanged.
Sorry, this could happen if you remove and re add to your account. If someone else added to a different account it would not affect your records.
Your audit log should show details of change, https://dash.cloudflare.com/?to=/:account/audit-log
All changes are logged. You may need to download the csv of all events to perfrom a more thurough search. You can review the address when it was added initially along with any changes.
Someone else adding your domain doesn’t change the IP, adding your own domain to a new account with a DNS scan can return the wrong IP in the new account and when you change the nameservers you’re pointed to the incorrect location as it wasn’t corrected by whoever added it and changed the nameservers. No idea if that is what happened in this case, @cloonan was just pointing to a common cause.
Interesting. I’ve downloaded the CSV and searched for the IP addresses in the records and the only ones I see are the two events where I deleted each extra record today when I changed it back to our origin IP.
I’ll try reaching out to CF support to see if there is something they can find.
Search for the resource ID to review all changes for that record.
