Flip Off Proxying Across Your Whole Account: Cloudflare's Enforce DNS-only!

Hey there, it's me, Shii-chan! Today I've got a slightly scary but very reassuring "emergency switch" from Cloudflare to share with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's DNS now has a new setting called enforce_dns_only that disables reverse proxying across all zones in your account at once. This was announced in the Cloudflare Changelog.

When you turn it on, DNS queries for proxied records return your origin IP addresses instead of Cloudflare's anycast IPs. It's an account-level kill switch designed for moments when you need to route traffic straight to your origin servers.

The story so far

Until now, to send traffic straight to your origin instead of through Cloudflare, you had to flip the proxy status per record (gray-cloud each one). With lots of zones and records, switching them all quickly in an emergency was a real chore.

With the new enforce_dns_only, a single API call applies it to every zone in your account at once.

What changes

The speed of incident response changes. When you urgently need traffic to reach your origin without going through Cloudflare, you no longer have to touch zones one by one.

It's also non-destructive: it does not rewrite your DNS records. Disable the setting and normal proxy behavior comes right back.

But here's the important part. The original post carries a strong warning.

Enabling this setting exposes your origin IP addresses and removes all Cloudflare protections — including DDoS mitigation, WAF, caching, and all other proxy-based features — for every zone in your account.

In other words, turning it on exposes your origin IPs and strips away Cloudflare protections like DDoS mitigation, WAF, and caching across every zone. Handle it with great care.

Dive Deep

Here are the characteristics I could pull from the Enforce DNS-only documentation.

• Account-level: a single API call affects all zones in the account simultaneously.
• Non-destructive: it does not modify your DNS records; disabling it restores normal proxy behavior.
• API-only: it's not in the Cloudflare dashboard, only through the API.

The scope is clear, too. Included are standard proxied A, AAAA, and CNAME records, Load Balancing records, and records matching Worker routes.

Excluded are Spectrum applications, Cloudflare Tunnel CNAMEs, R2 custom domains, Web3 gateways, and Workers custom domains, which keep operating normally.

Before enabling, the docs suggest verifying origin server capacity, reviewing visible IPs, and testing in staging. There's a detailed preparation guide too, so be sure to read it before using this in production.

Availability: via API to all Cloudflare customers.

Wrap-up

• A new setting, enforce_dns_only, can disable proxying across every zone in your account at once.
• It's an API-only kill switch for incident response, and it's non-destructive since it doesn't rewrite DNS records.
• Turning it on exposes origin IPs and removes protections like DDoS mitigation, WAF, and caching everywhere, so save it for real emergencies.
• It's a great fit for SREs and infra folks running many zones who want a fast "straight to origin" option when things go sideways.