Cloudflare

Export a DNS zone record

Outcome: Keep a dated, portable record of DNS configuration outside Cloudflare.

Method: Use the zone's DNS Records area and its Import and Export control to export the DNS records, then place the file in an approved location.

Limitations: A DNS export covers DNS records only. It does not represent every Cloudflare product setting, such as Workers, redirects, WAF rules, or account access controls.

1. Open the intended Cloudflare zone and locate DNS Records.
2. Use Import and Export, then export the zone records in the documented format.
3. Store the export in an approved location outside the Cloudflare account.
4. Record the zone name, export date, and responsible owner without placing credentials in the record.

Verification or retest: Open the saved file with the approved DNS tooling or a text viewer, confirm the expected records are present, and repeat the export after material DNS changes.

Completion evidence: A dated DNS zone export stored in an approved external location.

Cloudflare Docs: import and export DNS records ↗

Safety: Do not upload the zone file or its contents to SIU.

Review API token scope

Outcome: Limit each Cloudflare API token to the smallest practical permission and resource set.

Method: Inventory the token's owner and purpose, then create or replace it with only the permissions and resources that documented integration requires.

Limitations: The safe minimum scope depends on the integration. SIU cannot determine a customer's required permissions or validate a token configuration.

1. List each token's named owner, purpose, integration, and next review date without recording its value.
2. Confirm the documented permissions and account or zone resources required by that integration.
3. Create or update a scoped token using the smallest practical permissions and resources.
4. Consider the documented IP or expiry restrictions when they fit the integration's operating model.

Verification or retest: Test the integration in its approved environment, confirm its required operation succeeds, and review the inventory on the recorded date.

Completion evidence: A token inventory with owner, purpose, scope summary, and review date; no token values are recorded.

Cloudflare Docs: create an API token ↗

Safety: Never paste token values, credentials, or recovery codes into SIU.

Create an account-access runbook

Outcome: Give authorized operators a documented route to account, zone, registrar, and recovery information.

Method: Document approved owners, recovery contacts, and the protected locations of account and domain information; ask a second authorized operator to locate the record.

Limitations: This is reviewed SIU operational guidance, not a Cloudflare-prescribed recovery procedure. It must follow the organization's access, registrar, and incident policies.

1. Record the account and zone identifiers, authorized owners, registrar, and approved recovery contact route in protected documentation.
2. Record where approved recovery information is held without copying secrets into the runbook.
3. Ask a second authorized operator to locate the runbook using the organization's normal access process.
4. Set a review date and update the record after ownership or registrar changes.

Verification or retest: Have the second authorized operator confirm they can find the record, then repeat after material ownership or access changes.

Completion evidence: A protected runbook reviewed by another authorized operator.

Safety: Keep recovery information outside public source control and do not provide it to SIU.

Define an origin verification check

Outcome: Document a controlled origin check with an expected path, response code, and response marker.

Method: Choose a meaningful, controlled origin path; record expected results; and, where suitable for the account, configure the documented Health Checks settings or an owner-controlled equivalent.

Limitations: Health Checks availability, billing, and suitable configuration depend on the Cloudflare account and plan. A check must not expose an origin or create avoidable production load.

1. Select a meaningful application path that can be checked without exposing the origin publicly.
2. Record the expected protocol, status code, and response marker for that path.
3. Where available and approved, configure the corresponding Cloudflare Health Checks fields or document an owner-controlled equivalent.
4. Store the check owner and the approved response path in the service runbook.

Verification or retest: Run the approved controlled check, compare it with the expected response, and retest after meaningful origin or routing changes.

Completion evidence: A documented origin check with expected response and named owner.

Cloudflare Docs: Health Checks ↗

Safety: Do not use SIU as a monitoring endpoint or expose private origin details in a public form.

Map configuration that needs recovery

Outcome: Separate exportable DNS records, reviewed non-secret configuration, and protected secrets.

Method: Maintain a scoped configuration inventory that identifies what can be exported, what is maintained as reviewed non-secret configuration, and where protected secrets are managed.

Limitations: This is reviewed SIU operational guidance. Cloudflare's DNS export documentation does not state that every edge product can be exported or recreated through one procedure.

1. List DNS records and other material edge settings separately.
2. Mark which DNS records can be exported using the documented Cloudflare DNS procedure.
3. Keep reviewed non-secret configuration in an approved controlled location.
4. Record the protected secret-management location rather than copying secret values into the inventory.

Verification or retest: Review the inventory after a material edge change and exercise only an approved non-production or maintenance-window test with a rollback plan.

Completion evidence: A reviewed configuration inventory or controlled restoration runbook.

Safety: Do not run a production recovery drill without owner authorization, a maintenance window when needed, and a rollback path.

Document a controlled recovery route

Outcome: Name an authorized owner, decision condition, reversible steps, rollback, and verification locations.

Method: Use the organization's change process to identify the authorized decision maker, the trigger for a change, a reversible sequence, rollback, and verification locations.

Limitations: This is reviewed SIU operational guidance, not a vendor-directed Cloudflare procedure. It does not authorize a production change or replace the organization's incident process.

1. Name the role authorized to initiate the documented change.
2. Define the observed condition and approval boundary that warrant the change.
3. Write the smallest reversible sequence and an explicit rollback step.
4. Record approved private and public verification locations without placing sensitive endpoints in SIU.

Verification or retest: Review the route with the authorized owner and rehearse only an approved non-production or maintenance-window scenario after a material change.

Completion evidence: A controlled recovery route with named owner, decision criteria, rollback, and verification locations.

Safety: Production changes require owner authorization and an approved rollback path.