Subdomain (another IP) constantly changes A record to IP of main domain

What is the name of the domain?

What is the issue you’re encountering

Subdomain (another network address) constantly changes A record to IP of main domain. How to stabilize IP of subdomain?

What steps have you taken to resolve the issue?

I read the discussions. For example:

What feature, service or problem is this related to?

DNS records

What are the steps to reproduce the issue?

I have 2 different servers (so 2 different IP addresses).
Specify different IPs for the main domain and subdomain (А-record-1 & A-record-2).
Everything works fine, BUT…

After some time, the IP address in the subdomain’s A record becomes the same as that of the main domain!
I don’t understand Why.

P.S. Main domain = Proxied. Subdomain = DNS only.
Both IPs are dynamic (they exist behind the CG-NAT).

Subdomain is used to read IP address data (original, permanent). Main domain changes the address. I don’t need proxy for subdomain. I need A record of subdomain to show the address I wrote there. Not the address of main domain.

Check your audit log to find out what updates the IP.

Since you said the IPs are dynamic, I guess the most likely cause is a problem in your update logic.

Laudian, Thanks for your response.
I don’t have “update logic”.
I wrote above - “CG-NAT” so I don’t use DDNS (it’s pointless).

At the moment of creation, the A record of the subdomain contains the current external IP. At this moment, it matches the external IP of the main domain. So I get the message:
This record exposes the IP address used in the A record on <main.domain>, which you have proxied through Cloudflare.
I ignore it.

At some time, the IP of the main domain changes. I do not make any changes in DNS! Tunnels work.
But along with the change of the A record of the main domain (which changed the IP), the A record of the subdomain also changes (I repeat - I do not change it).
My question is exactly this:
Who and Why changes the A record of the subdomain?

The subdomain is DNS only.

So, did you check the audit log to see why it was changed?

Also, please share the actual hostnames.

1 Like

The logs show that the DNS changes were made via “Interface: API”. The interval is 1 second. Simultaneously in the A record of the main domain and in the A record of the subdomain.

I assumed so. But how can I make the main domain change, but not the subdomain?

Do you use Ezoic?

I have only:
services:

  • cloudflared:*
  • image: cloudflare/cloudflared:latest*
  • command: tunnel run*
  • environment:*
  •  - TUNNEL_TOKEN=xxxxx*
    
  • restart: always*

What is this?

What does Cloudflared have to do with anything?

Please share the actual hostnames and how your setup works.

Sorry, I don’t understand.
English is not my language.

When creating an account on the site
Cloudflare / Select tunnel type / … / Route tunnel / Choose your environment / Docker
I received the text.
I wrote it above. I don’t use any other API for Cloudflare.

Sorry, I don’t understand - who are you? User? Administrator?
I would not like to write any domains in public access.

I don’t use this.

I’m a user, just like you.

That’s ok, but I’m afraid I can’t help you if you are not willing to share any details.

It’s sad. But I don’t give out names, addresses, passwords, etc. That’s my habit. If I can’t solve the problem on Cloudflare, then I’ll look for another service.

Oops. Got it!
I assume that my question is not difficult for a professional:

How to make A-record of subdomain Read-only
(like TXT-record/DKIM = on the left is a lock icon)?

If the change is being made via API whatever is changing one IP is changing the other. If you are not automating your changes rotate your API key so whatever is making the changes will stop. If you are rotating the IP via automation change your automation to only rotate the record you want it to rotate.

1 Like
  • this is not exact.
    My screenshot shows that there is a LOCK on the TXT record (and on the MX record). And when changing the IP of the main domain - the IP in the MX record does NOT change. This is exactly what I am looking for.

I don’t change anything. All changes are made by the Cloudflare connector. I don’t know how to change its parameters. And if I change its parameters, the tunnels won’t work.

I’ll repeat for about the sixth time - I’m not changing ANYTHING. I’m using the result of what Cloudflare itself did when creating my account.

I don’t need to undo anything. I need the Cloudflare connector to NOT TOUCH one subdomain when updating data for the main domain and subdomains (tunnels) (just like it doesn’t change the IP in the MX record).

How do I LOCK a record?