Cloudflare network security checks
IP allow-lists, TLS, DNS and edge settings that keep the application reachable only from where it should be.
On Cloudflare, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Cloudflare connector needs.
Checks (3)
severity: medium DNS Wildcard Record fix difficulty: medium #
Review and remove unnecessary DNS wildcard records to reduce the attack surface
- Log in to the Cloudflare Dashboard and select the zone
- Navigate to DNS > Records
- Identify wildcard records (starting with *.)
- Replace wildcard records with specific subdomain records where possible
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: medium DNS Record Points to Private IP fix difficulty: easy #
Remove or correct DNS A records pointing to RFC 1918 private IP addresses
- Log in to the Cloudflare Dashboard and select the zone
- Navigate to DNS > Records
- Identify A records pointing to private IP ranges (10.x, 172.16-31.x, 192.168.x)
- Update the record to point to a public IP or remove it if no longer needed
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: low DNS Record Not Proxied fix difficulty: easy #
Enable Cloudflare proxy for A/AAAA DNS records to hide the origin server IP address
- Log in to the Cloudflare Dashboard and select the zone
- Navigate to DNS > Records
- Click the grey cloud icon next to the record to enable proxying (orange cloud)
- Verify the origin IP is no longer exposed via DNS lookup
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9