Cloudflare DNS plugin
The Cloudflare DNS plugin lets a Vaubaan Gateway mission use Cloudflare DNS without handing the agent a credential. DNS zones and records on Cloudflare : records, BIND import / export, zone settings, DNSSEC and cache purge — one resource per zone.
- Version:
3.0.0(package@vaubaan/plugin-cloudflare-dns) - Status: stable
- Health: not enough reports yet — what this means
- Source: plugins/cloudflare-dns, catalog risk-catalog.yaml version 3 of 2026-10-14
- How to connect an account: Connect Cloudflare DNS
- How it is modelled: handbook
One account is one Cloudflare API token; one resource is one DNS zone (a domain). A mission touches only the zones it was given. DNS has no environment: ordinary records, apex / MX / NS changes, deletions, imports and zone settings are separate permissions instead.
Permissions
Each permission is a named risk of the plugin's catalog: a mission holds an explicit list of them, never "all". The severity is computed from the permission's six axes (undo, blast radius, data, cost, visible to, lasts); nothing is decided from it.
| Permission | What it allows | Severity | Why it is a risk |
|---|---|---|---|
cloudflare-dns.read-zone-metadata | Read zone and account metadata | low | Inventory of zones, status, nameservers, plan, zone settings and DNSSEC posture. Metadata only, no secrets, no record values. Note that `zone[**].R` is recursive : reading records needs this permission too, so a mission that reads records holds both. |
cloudflare-dns.read-records | Read DNS records (IPs, CNAMEs, MX, TXT values) | low | Exposes the network topology (server IPs, MX relays, SPF/DKIM/DMARC configuration, ACME challenges). Reconnaissance surface for an attacker. |
cloudflare-dns.export-zone-file | Export the whole zone as a BIND file (all records in one dump) | low | Atomic export of every record in BIND format — the complete DNS topology in a single request. Distinct from read-records (paginated) because the export is a one-call bulk exfiltration vector. |
cloudflare-dns.record-write | Create / update a DNS record | medium | Posture shift on a DNS record. A changed A/CNAME redirects traffic ; a changed TXT invalidates SPF/DKIM (mail) or ACME (TLS). Costly to revert because the previous value must be known (no DNS versioning). Public by nature. Touched by every record write, including the critical ones and the deletions, which also need their own permission. |
cloudflare-dns.critical-record-write | Change an apex, wildcard, MX or NS record | high | The record governs the whole domain rather than one host : the apex (`example.com`, `@`) or the wildcard at the apex redirects the main site and every undefined subdomain ; MX reroutes all incoming mail ; NS delegates a subtree to another nameserver. Emitted next to the ordinary record write, so a mission holds it distinctly. When the arguments do not name the record's type and name, the write counts as critical. |
cloudflare-dns.record-delete | Delete a DNS record | medium | Removes a record ; the host, mail route or validation token it served stops resolving immediately. Costly to revert : the previous value is gone and must be recovered from elsewhere. Emitted as a verb leaf so a mission can allow edits without allowing deletions. |
cloudflare-dns.import-records | Bulk import DNS records from a BIND zone file | high | A BIND import creates or overwrites potentially hundreds of records in one call, apex and MX included. Higher blast than a single record write ; non-atomic (partial import on error). Rate-limited upstream. |
cloudflare-dns.zone-settings-write | Edit zone settings (SSL mode, minimum TLS, cache level…) | high | Modifies the security posture of the zone. Lowering the minimum TLS version re-enables known weaknesses ; switching SSL from Full (strict) to Flexible opens the origin leg to interception. |
cloudflare-dns.dnssec-write | Enable / disable DNSSEC on a zone | high | Toggling DNSSEC without the matching DS record at the registrar breaks resolution (SERVFAIL on validating resolvers). Zone-wide security posture shift. |
cloudflare-dns.cache-purge | Purge the CDN cache (everything, by URL, tag, host or prefix) | medium | A purge-everything sends every request to the origin — a self-inflicted load spike on a busy site. Reversible (the cache rebuilds) but with an immediate performance cost. |
cloudflare-dns.zone-delete | Delete a whole DNS zone (the domain stops resolving) | critical | Deletes the zone. The domain stops resolving at once ; every record, setting and the DNSSEC configuration are lost. Irreversible in practice — the zone must be recreated and every record reimported. Listed in no preset : a mission that needs it enumerates it explicitly. The pattern ends on the zone ident (`zone[*]`, not `zone[**]`) : a recursive wildcard would make every record or settings write need this irreversible permission. |
cloudflare-dns.uncategorized-write | Uncategorized Cloudflare DNS write | high (the catch-all: touched only by a call no other permission covers) | Catch-all for writes without a dedicated entry. Seen in production, it means a tool classifies to a slice no entry covers : add the entry. |
Presets
A preset pre-fills the permissions of a mission for one account, with a limit per period, a rate and whether each permission runs freely or asks the mission creator first. The person creating the mission adjusts it; the mission stores the explicit list.
Read-only
read-only — Zone metadata, settings, DNSSEC posture and record values of the selected zones. No export, no write.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
cloudflare-dns.read-zone-metadata | Read zone and account metadata | 2000 | 120 per minute | runs freely |
cloudflare-dns.read-records | Read DNS records (IPs, CNAMEs, MX, TXT values) | 2000 | 120 per minute | runs freely |
DNS operator
dns-operator — Read, then create and update ordinary subdomain records and purge the cache. No apex / MX / NS change, no deletion, no import, no zone settings.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
cloudflare-dns.read-zone-metadata | Read zone and account metadata | 2000 | 120 per minute | runs freely |
cloudflare-dns.read-records | Read DNS records (IPs, CNAMEs, MX, TXT values) | 2000 | 120 per minute | runs freely |
cloudflare-dns.record-write | Create / update a DNS record | 500 | 30 per minute | runs freely |
cloudflare-dns.cache-purge | Purge the CDN cache (everything, by URL, tag, host or prefix) | 50 | 10 per minute | runs freely |
Zone admin
zone-admin — Everything on the selected zones except deleting them; record deletion, apex / MX / NS changes, imports, zone settings and DNSSEC ask first.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
cloudflare-dns.read-zone-metadata | Read zone and account metadata | 5000 | 120 per minute | runs freely |
cloudflare-dns.read-records | Read DNS records (IPs, CNAMEs, MX, TXT values) | 5000 | 120 per minute | runs freely |
cloudflare-dns.export-zone-file | Export the whole zone as a BIND file (all records in one dump) | 50 | 10 per minute | runs freely |
cloudflare-dns.record-write | Create / update a DNS record | 1000 | 60 per minute | runs freely |
cloudflare-dns.critical-record-write | Change an apex, wildcard, MX or NS record | 50 | 10 per minute | ask me first |
cloudflare-dns.record-delete | Delete a DNS record | 200 | 30 per minute | ask me first |
cloudflare-dns.import-records | Bulk import DNS records from a BIND zone file | 10 | 3 per minute | ask me first |
cloudflare-dns.zone-settings-write | Edit zone settings (SSL mode, minimum TLS, cache level…) | 50 | 10 per minute | ask me first |
cloudflare-dns.dnssec-write | Enable / disable DNSSEC on a zone | 10 | 5 per minute | ask me first |
cloudflare-dns.cache-purge | Purge the CDN cache (everything, by URL, tag, host or prefix) | 100 | 20 per minute | runs freely |
Tools
| Tool | What it does |
|---|---|
cloudflare_dns__list_zones | List DNS zones |
cloudflare_dns__get_zone | Read a DNS zone |
cloudflare_dns__list_records | List DNS records |
cloudflare_dns__get_record | Read a DNS record |
cloudflare_dns__export_records | Export the DNS records of a zone |
cloudflare_dns__get_zone_settings | Read the settings of a zone |
cloudflare_dns__get_dnssec | Read the DNSSEC status |
cloudflare_dns__create_record | Create a DNS record |
cloudflare_dns__update_record | Change a DNS record |
cloudflare_dns__delete_record | Delete a DNS record |
cloudflare_dns__import_records | Import DNS records in bulk |
cloudflare_dns__edit_zone_settings | Change the settings of a zone |
cloudflare_dns__purge_cache | Purge the cache of a zone |
cloudflare_dns__edit_dnssec | Turn DNSSEC on or off |
cloudflare_dns__delete_zone | Delete a DNS zone |
Health
Health: not enough reports yet. A plugin version is deemed validated by the community with at least 200 reports and 90 % of them successful, over the last 90 days, as reported by the instances whose operators turned community telemetry on. It is a community signal, not a security guarantee.