{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/",
        "slug": "preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file",
        "url": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/"
        },
        "title": "Preserve Cloudflare proxy and record attributes when moving DNS through a zone file",
        "summary": "A BIND-format import can carry configuration beyond the visible address values.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:16:56+00:00",
        "modified_at": "2026-10-20T18:34:36+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 252,
        "potentially_affected": "This concerns Cloudflare DNS record import/export.",
        "dse_recommendation": "DSE recommends retaining an untouched export and reviewing a working copy before import.",
        "primary_source": {
            "name": "Cloudflare — Import and export records",
            "url": "https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/",
            "published_on": null,
            "authority": "developers.cloudflare.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A BIND-format import can carry configuration beyond the visible address values.</p>\n<h2>Source facts</h2>\n<p>Cloudflare documents BIND zone-file import and export, with fully qualified targets ending in a period for relevant record types. Imported applicable records can be proxied unless that option is disabled. Comments and tags use inline metadata, including reserved cf- tags that represent Cloudflare-specific settings. An exported file therefore needs more review than a simple list of hostnames and addresses.</p>\n<p>Source: <a href=\"https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/\">Cloudflare — Import and export records</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns Cloudflare DNS record import/export.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends retaining an untouched export and reviewing a working copy before import. Validate target-name qualification, record types, TTLs, and proxy intentions alongside comments and reserved tags. Keep mail and third-party verification records in the review rather than importing only web addresses. Use the narrow permissions needed for the operation and keep API credentials separate from the zone file and change evidence. Keep a comparison column for values and another for Cloudflare-specific attributes. Ask the destination owner to approve proxy intent for mail, proof, and web names individually. Reject a migration comparison that ignores reserved inline tags merely because the visible record targets appear to match.</p>\n<h2>Verification</h2>\n<p>Import a representative file into a controlled zone and compare its records and relevant attributes with the source. Query fully qualified targets to detect accidental suffix expansion. Confirm intended proxy state and dependent web, mail, or verification behavior separately before using the same process for a production migration.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/\">Cloudflare — Import and export records</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A BIND-format import can carry configuration beyond the visible address values.\nSource facts\nCloudflare documents BIND zone-file import and export, with fully qualified targets ending in a period for relevant record types. Imported applicable records can be proxied unless that option is disabled. Comments and tags use inline metadata, including reserved cf- tags that represent Cloudflare-specific settings. An exported file therefore needs more review than a simple list of hostnames and addresses.\nSource: Cloudflare — Import and export records.\nApplicability\nThis concerns Cloudflare DNS record import/export.\nDSE recommendation\nDSE recommends retaining an untouched export and reviewing a working copy before import. Validate target-name qualification, record types, TTLs, and proxy intentions alongside comments and reserved tags. Keep mail and third-party verification records in the review rather than importing only web addresses. Use the narrow permissions needed for the operation and keep API credentials separate from the zone file and change evidence. Keep a comparison column for values and another for Cloudflare-specific attributes. Ask the destination owner to approve proxy intent for mail, proof, and web names individually. Reject a migration comparison that ignores reserved inline tags merely because the visible record targets appear to match.\nVerification\nImport a representative file into a controlled zone and compare its records and relevant attributes with the source. Query fully qualified targets to detect accidental suffix expansion. Confirm intended proxy state and dependent web, mail, or verification behavior separately before using the same process for a production migration.\nOfficial reference\nCloudflare — Import and export records. Reviewed October 20, 2026.",
        "content_markdown": "A BIND-format import can carry configuration beyond the visible address values.\n\n## Source facts\n\nCloudflare documents BIND zone-file import and export, with fully qualified targets ending in a period for relevant record types. Imported applicable records can be proxied unless that option is disabled. Comments and tags use inline metadata, including reserved cf- tags that represent Cloudflare-specific settings. An exported file therefore needs more review than a simple list of hostnames and addresses.\n\nSource: [Cloudflare — Import and export records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/).\n\n## Applicability\n\nThis concerns Cloudflare DNS record import/export.\n\n## DSE recommendation\n\nDSE recommends retaining an untouched export and reviewing a working copy before import. Validate target-name qualification, record types, TTLs, and proxy intentions alongside comments and reserved tags. Keep mail and third-party verification records in the review rather than importing only web addresses. Use the narrow permissions needed for the operation and keep API credentials separate from the zone file and change evidence. Keep a comparison column for values and another for Cloudflare-specific attributes. Ask the destination owner to approve proxy intent for mail, proof, and web names individually. Reject a migration comparison that ignores reserved inline tags merely because the visible record targets appear to match.\n\n## Verification\n\nImport a representative file into a controlled zone and compare its records and relevant attributes with the source. Query fully qualified targets to detect accidental suffix expansion. Confirm intended proxy state and dependent web, mail, or verification behavior separately before using the same process for a production migration.\n\n## Official reference\n\n[Cloudflare — Import and export records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/",
                "url": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Preserve Cloudflare proxy and record attributes when moving DNS through a zone file",
                        "item": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/#article",
                "identifier": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/",
                "url": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/",
                "headline": "Preserve Cloudflare proxy and record attributes when moving DNS through a zone file",
                "description": "A BIND-format import can carry configuration beyond the visible address values.",
                "abstract": "A BIND-format import can carry configuration beyond the visible address values.",
                "articleBody": "A BIND-format import can carry configuration beyond the visible address values.\nSource facts\nCloudflare documents BIND zone-file import and export, with fully qualified targets ending in a period for relevant record types. Imported applicable records can be proxied unless that option is disabled. Comments and tags use inline metadata, including reserved cf- tags that represent Cloudflare-specific settings. An exported file therefore needs more review than a simple list of hostnames and addresses.\nSource: Cloudflare — Import and export records.\nApplicability\nThis concerns Cloudflare DNS record import/export.\nDSE recommendation\nDSE recommends retaining an untouched export and reviewing a working copy before import. Validate target-name qualification, record types, TTLs, and proxy intentions alongside comments and reserved tags. Keep mail and third-party verification records in the review rather than importing only web addresses. Use the narrow permissions needed for the operation and keep API credentials separate from the zone file and change evidence. Keep a comparison column for values and another for Cloudflare-specific attributes. Ask the destination owner to approve proxy intent for mail, proof, and web names individually. Reject a migration comparison that ignores reserved inline tags merely because the visible record targets appear to match.\nVerification\nImport a representative file into a controlled zone and compare its records and relevant attributes with the source. Query fully qualified targets to detect accidental suffix expansion. Confirm intended proxy state and dependent web, mail, or verification behavior separately before using the same process for a production migration.\nOfficial reference\nCloudflare — Import and export records. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:16:56+00:00",
                "dateModified": "2026-10-20T18:34:36+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Preserve Cloudflare proxy and record attributes when moving DNS through a zone file"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 252,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Cloudflare — Import and export records",
                    "url": "https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/"
                }
            }
        ]
    }
}