You can now disable Cloudflare’s reverse proxy across all zones in your account simultaneously using the new enforce_dns_only setting. When enabled, Cloudflare responds to DNS queries for all proxied records with your origin IP addresses instead of Cloudflare’s anycast IPs.
This account-level kill switch is designed for incident response scenarios where you need to quickly route traffic directly to your origin servers.
Key characteristics
- Account-level — Affects all zones in the account simultaneously with a single API call.
- Non-destructive — Does not modify your DNS records. Disabling the setting restores normal proxy behavior.
- API-only — Available through the API only, not in the Cloudflare dashboard.
What’s affected
Included: Standard proxied A, AAAA, and CNAME records, Load Balancing records, and records matching Worker routes.
Excluded: Spectrum applications, Cloudflare Tunnel CNAMEs, R2 custom domains, Web3 gateways, and Workers custom domains continue to operate normally.
Before you enable
- Verify your origin servers can handle direct traffic without Cloudflare’s caching and filtering.
- Review which origin IPs will become publicly visible through DNS queries.
- Test the API in a staging account before relying on it for incident response.
Availability
Available via API to all Cloudflare customers.
For information on how to use it, refer to Enforce DNS-only developer documentation .
Source: Cloudflare
Latest Posts
- MC1431377: Microsoft Defender for Office 365 Pauses Auto-Refresh and Adds Manual Refresh with Simplified Investigation Naming
- MC1422063: OneDrive for Business Adds Guided Fix for Max Path Errors in Windows Desktop Sync
- MC1420901: Microsoft 365 Copilot App Adds Notebooks for Organized Project Work and OneNote Sync
- MC1401303: Microsoft Teams Adds Events Templates with Optimize for Large Audience and Policy-Based Controls
