# Reconcile Cloudflare's onboarding scan with the authoritative DNS inventory

> Pattern-based discovery can miss unusual hostnames and custom DKIM selectors.

- Canonical URL: https://update.dsesecurity.com/updates/reconcile-cloudflare-s-onboarding-scan-with-the-authoritative-dns-inventory/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:17:00+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Pattern-based discovery can miss unusual hostnames and custom DKIM selectors.

## Potentially affected

This concerns Cloudflare's onboarding DNS scan.

## DSE recommendation

DSE recommends obtaining an authoritative export or provider inventory and reconciling the scan row by row.

## Article

Pattern-based discovery can miss unusual hostnames and custom DKIM selectors.

## Source facts

Cloudflare states that its quick scan uses recurring record type/name patterns rather than a complete zone-specific inventory. Unusual service names and custom DKIM selectors may not be discovered. The guide explicitly instructs users to review records and add missing entries before changing nameservers. A successful scan therefore does not establish migration completeness.

Source: [Cloudflare — Records quick scan](https://developers.cloudflare.com/dns/zone-setups/reference/dns-quick-scan/).

## Applicability

This concerns Cloudflare’s onboarding DNS scan.

## DSE recommendation

DSE recommends obtaining an authoritative export or provider inventory and reconciling the scan row by row. Include mail routing, authentication, verification, SRV records, uncommon application subdomains, and delegations. Ask service owners about names not visible in a generic website check. Preserve the original export and log deliberate omissions so a later delivery or login failure can be investigated against an actual migration record. Give each unmatched inventory row an explicit disposition: import, deliberate retirement, or unresolved owner review. Ask the mail owner to check custom selector names and the application owner to check uncommon service records. Leave cutover incomplete while an essential name has no accepted disposition.

## Verification

Before cutover, compare the proposed Cloudflare zone with the approved inventory by record type, owner name, and value. Query representative uncommon names directly against the assigned authoritative servers. After activation, test the dependent services and confirm no records were silently omitted merely because the public homepage and www address work.

## Official reference

[Cloudflare — Records quick scan](https://developers.cloudflare.com/dns/zone-setups/reference/dns-quick-scan/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Records quick scan
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/dns/zone-setups/reference/dns-quick-scan/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Reconcile Cloudflare's onboarding scan with the authoritative DNS inventory,” DSE Security, https://update.dsesecurity.com/updates/reconcile-cloudflare-s-onboarding-scan-with-the-authoritative-dns-inventory/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.