Recommended DNS policies

We recommend you add the following DNS policies to build an Internet and SaaS app security strategy for your organization.

All-DNS-Domain-Allowlist

Allowlist any known domains and hostnames. With this policy, you ensure that your users can access your organization's domains even if the domains fall under a blocked category, such as Newly Seen Domains or Login Screens.

Dashboard

Selector	Operator	Value	Logic	Action
Domain	in list	Known Domains	Or	Allow
Host	in list	Known Domains

API

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <API TOKEN>" \
  --data '{
  "name": "All-DNS-Domain-Allowlist",
  "description": "Organization-wide whitelist. Explicitly allow resolution of these DNS domains",
  "precedence": 0,
  "enabled": false,
  "action": "allow",
  "filters": [
    "dns"
  ],
  "traffic": "any(dns.domains[*] in $<Global Whitelist UUID>) or dns.fqdn in $<Global Whitelist UUID>"
}'

Terraform

resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" {
  account_id  = var.account_id
  name        = "All-DNS-Domain-Allowlist"
  description = "Organization-wide whitelist. Explicitly allow resolution of these DNS domains"
  precedence  = 0
  enabled     = false
  action      = "allow"
  filters     = ["dns"]
  traffic     = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}) or dns.fqdn in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}"
}

Quarantined-Users-DNS-Restricted-Access

Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected.

Dashboard

Selector	Operator	Value	Logic	Action
Domain	not in list	Allowed Remediation Domains	Or	Block
Host	not in list	Allowed Remediation Domains	And
User Group Names	in	Quarantined Users

API

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <API TOKEN>" \
  --data '{
  "name": "Quarantined-Users-DNS-Restricted-Access",
  "description": "Restrict quarantined users traffic to corporate policy remediation domains, so that quarantined users can obtain help and/or remediate their security posture",
  "precedence": 10,
  "enabled": false,
  "action": "block",
  "filters": [
    "dns"
  ],
  "traffic": "not(any(dns.domains[*] in $<Allowed Remediation Domains list UUID>)) or not(any(dns.domains[*] in $<Allowed Remediation Domains list UUID>))",
  "identity": "any(identity.groups.name[*] in {\"Quarantined Users\"})",
  "rule_settings": {
    "block_page_enabled": true,
    "notification_settings": {
      "enabled": true
    }
  }'

Terraform

resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users" {
  account_id  = var.account_id
  name        = "Quarantined-Users-DNS-Restricted-Access"
  description = "Restrict quarantined users traffic to corporate policy remediation domains, so that quarantined users can obtain help and/or remediate their security posture"
  precedence  = 10
  enabled     = false
  action      = "block"
  filters     = ["dns"]
  traffic     = "not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id})) or not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id}))"
  identity    =  "any(identity.groups.name[*] in {\"Quarantined Users\"})"
  rule_settings {
      block_page_enabled = true
      notification_settings {
          enabled = true
        }
    }
}

All-DNS-SecurityCategories-Blocklist

Block security categories, such as Command and Control & Botnet and Malware, based on Cloudflare's threat intelligence.

Selector	Operator	Value	Action
Security Categories	in	All security risks	Block

All-DNS-ContentCategories-Blocklist

Entries in the security risk content subcategory, such as New Domains, do not always pose a security threat. We recommend you first create an Allow policy to track policy matching and identify any false positives. You can add false positives to your Trusted Domains list used in All-DNS-Domain-Allowlist.

After your test is complete, we recommend you change the action to Block to minimize risk to your organization.

Selector	Operator	Value	Action
Content Categories	in	Security Risks	Allow

All-DNS-Application-Blocklist

Block unauthorized applications to limit your users' access to certain web-based tools and minimize the risk of shadow IT. For example, the following policy blocks popular AI chatbots.

Selector	Operator	Value	Action
Application	in	Microsoft Copilot, ChatGPT, Google Gemini	Block

All-DNS-GeoCountryIP-Blocklist

Block websites hosted in countries categorized as high risk. The designation of such countries may result from your organization's users or through the implementation of regulations including EAR ↗, OFAC ↗, and ITAR ↗.

Dashboard

Selector	Operator	Value	Action
Resolved Country IP Geolocation	in	Afghanistan, Belarus, Congo (Kinshasa), Cuba, Iran, Iraq, Korea (North), Myanmar, Russian Federation, Sudan, Syria, Ukraine, Zimbabwe	Block

API

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <API TOKEN>" \
  --data '{
  "name": "All-DNS-GeoCountryIP-Blocklist",
  "description": "Block traffic hosted in countries categorized as high security risks",
  "precedence": 50,
  "enabled": false,
  "action": "block",
  "filters": [
    "dns"
  ],
  "traffic": "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})",
  "rule_settings": {
    "block_page_enabled": true,
    "block_reason": "This domain was blocked due to being classified as a security risk to the organisation"
    }
}'

Terraform

resource "cloudflare_zero_trust_gateway_policy" "dns_geolocation_block_policy" {
  account_id  = var.account_id
  name        = "All-DNS-GeoCountryIP-Blocklist"
  description = "Block traffic hosted in countries categorized as high security risks"
  precedence  = 50
  enabled     = false
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})"
  rule_settings {
      block_page_enabled = true
      block_page_reason = "This domain was blocked due to being classified as a security risk to the organisation"
    }
}

All-DNS-DomainTopLevel-Blocklist

Block frequently misused top-level domains (TLDs) to reduce security risks, especially when there is no discernible advantage to be gained from allowing access. Similarly, restricting access to specific country-level TLDs may be necessary to comply with regulations such as OFAC ↗ and ITAR ↗.

Dashboard

Selector	Operator	Value	Action
Domain	matches regex	[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$	Block

API

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <API TOKEN>" \
  --data '{
  "name": "All-DNS-DomainTopLevel-Blocklist",
  "description": "Block DNS queries of known risky TLDs",
  "precedence": 60,
  "enabled": false,
  "action": "block",
  "filters": [
    "dns"
  ],
  "traffic": "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")",
  "rule_settings": {
    "block_page_enabled": true,
    "block_reason": "This domain was blocked due to being classified as a security risk to the organisation"
    }
  }'

Terraform

resource "cloudflare_zero_trust_gateway_policy" "dns_blacklist_policy" {
  account_id  = var.account_id
  name        = "All-DNS-DomainTopLevel-Blocklist"
  description = "Block DNS queries of known risky TLDs"
  precedence  = 60
  enabled     = false
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")"
  rule_settings {
      block_page_enabled = true
      block_page_reason = "This domain was blocked due to being classified as a security risk to the organisation"
    }
}

All-DNS-DomainPhishing-Blocklist

Block misused domains to protect your users against sophisticated phishing attacks, such as domains that specifically target your organization. For example, the following policy blocks specific keywords associated with an organization or its authentication services (such as okta, 2fa, cloudflare and sso) while still allowing access to known domains.

Dashboard

Selector	Operator	Value	Logic	Action
Domain	not in list	Known Domains	And	Block
Domain	matches regex	.*okta.*|.*cloudflare.*|.*mfa.*|.sso.*

API

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <API TOKEN>" \
  --data '{
  "name": "All-DNS-DomainPhishing-Blocklist",
  "description": "Block misused domains used in phishing campaigns",
  "precedence": 70,
  "enabled": false,
  "action": "block",
  "filters": [
    "dns"
  ],
  "traffic": "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in $<Known Phishing Domains List UUID>))",
  "rule_settings": {
    "block_page_enabled": true,
    "block_reason": "This domain was blocked due to being classified as a security risk to the organisation"
    }

    }'

Terraform

resource "cloudflare_zero_trust_gateway_policy" "dns_phishing_domains_block" {
  account_id  = var.account_id
  name        = "All-DNS-DomainPhishing-Blocklist"
  description = "Block misused domains used in phishing campaigns"
  precedence  = 70
  enabled     = false
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.known_phishing_domains_list.id}))"
  rule_settings {
      block_page_enabled = true
      block_page_reason = "This domain was blocked due to being classified as a security risk to the organisation"
    }
}

All-DNS-ResolvedIP-Blocklist

Block specific IP addresses that are malicious or pose a threat to your organization.

You can implement this policy by either creating custom blocklists or by using blocklists provided by threat intelligence partners or regional Computer Emergency and Response Teams (CERTs). Ideally, your CERTs can update the blocklist with an API automation to provide real-time threat protection.

Dashboard

Selector	Operator	Value	Action
Resolved IP	in list	IP Blocklist	Block

API

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <API TOKEN>" \
  --data '{
  "name": "All-DNS-ResolvedIP-Blocklist",
  "description": "Block specific IP addresses deemed to be a risk to the Organization",
  "precedence": 80,
  "enabled": false,
  "action": "block",
  "filters": [
    "dns"
  ],
  "traffic": "any(dns.resolved_ips[*] in $<IP Blocklist UUID>)",
  "rule_settings": {
    "block_page_enabled": true,
    "block_reason": "This domain was blocked due to being classified as a security risk to the organisation"
    }
  }'

Terraform

resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule" {
  account_id  = var.account_id
  name        = "All-DNS-ResolvedIP-Blocklist"
  description = "Block specific IP addresses deemed to be a risk to the Organization"
  precedence  = 80
  enabled     = false
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.resolved_ips[*] in ${"$"}${cloudflare_zero_trust_list.ip_blocklist.id}"
  rule_settings {
      block_page_enabled = true
      block_page_reason = "This domain was blocked due to being classified as a security risk to the organisation"
    }
}

All-DNS-DomainHost-Blocklist

Block specific domains or hosts that are malicious or pose a threat to your organization. Like All-DNS-ResolvedIP-Blocklist, this blocklist can be updated manually or via API automation.

Selector	Operator	Value	Logic	Action
Domain	in list	Domain Blocklist	Or	Block
Host	in list	Host Blocklist	Or
Host	matches regex	.*example\.com

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!