Checkout

This is a security policy enforcement feature within the Cloudflare platform. It is designed for website and application administrators using Cloudflare's DNS and proxy services to manage their domains. The system automatically detects and blocks attempts to configure a CNAME record that points a hostname to a resource owned by a different Cloudflare user account. This prevents unauthorized domain mapping, a common vector for subdomain takeover attacks and configuration errors.

• Account Isolation Enforcement: Ensures that CNAME records can only point to destinations within the same Cloudflare account, maintaining clear ownership boundaries.
• Subdomain Takeover Prevention: Blocks a primary attack method where an attacker could claim an orphaned subdomain by pointing it to their own cloud resource.
• Configuration Error Mitigation: Stops accidental misconfigurations that could make a domain resolve to another user's bucket, website, or application.
• Automated Policy Action: The ban is applied automatically by Cloudflare's systems when a violating CNAME setup is detected, returning a specific error to visitors.
• Clear Error Messaging: Provides administrators with a defined error code (1014) and explanation, aiding in troubleshooting DNS record issues.