# Preserve Cloudflare proxy and record attributes when moving DNS through a zone file

> A BIND-format import can carry configuration beyond the visible address values.

- Canonical URL: https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:56+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A BIND-format import can carry configuration beyond the visible address values.

## Potentially affected

This concerns Cloudflare DNS record import/export.

## DSE recommendation

DSE recommends retaining an untouched export and reviewing a working copy before import.

## Article

A BIND-format import can carry configuration beyond the visible address values.

## Source facts

Cloudflare documents BIND zone-file import and export, with fully qualified targets ending in a period for relevant record types. Imported applicable records can be proxied unless that option is disabled. Comments and tags use inline metadata, including reserved cf- tags that represent Cloudflare-specific settings. An exported file therefore needs more review than a simple list of hostnames and addresses.

Source: [Cloudflare — Import and export records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/).

## Applicability

This concerns Cloudflare DNS record import/export.

## DSE recommendation

DSE recommends retaining an untouched export and reviewing a working copy before import. Validate target-name qualification, record types, TTLs, and proxy intentions alongside comments and reserved tags. Keep mail and third-party verification records in the review rather than importing only web addresses. Use the narrow permissions needed for the operation and keep API credentials separate from the zone file and change evidence. Keep a comparison column for values and another for Cloudflare-specific attributes. Ask the destination owner to approve proxy intent for mail, proof, and web names individually. Reject a migration comparison that ignores reserved inline tags merely because the visible record targets appear to match.

## Verification

Import a representative file into a controlled zone and compare its records and relevant attributes with the source. Query fully qualified targets to detect accidental suffix expansion. Confirm intended proxy state and dependent web, mail, or verification behavior separately before using the same process for a production migration.

## Official reference

[Cloudflare — Import and export records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Import and export records
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Preserve Cloudflare proxy and record attributes when moving DNS through a zone file,” DSE Security, https://update.dsesecurity.com/updates/preserve-cloudflare-proxy-and-record-attributes-when-moving-dns-through-a-zone-file/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.