Cloudflare Developers•2y ago

why does importing a bind file automatically turn on cloudflare protection? 😭

why does importing a bind file automatically turn on cloudflare protection?

threekatOP•3/5/24, 4:01 PM

i have to manually turn off thousands of records
edit: nvm wrote a shell script

Tthreekat why does importing a bind file automatically turn on cloudflare protection? 😭

Chaika•3/5/24, 4:30 PM

There's an option on import

Unsmart•3/5/24, 4:38 PM

Cloudflare Access pay-go has no limit but its $7/user/mo.

You probably want to remove cloudflare access and use your own auth, which I assume you probably already have in some way given its a discord bot.

CChaika There's an option on import

threekatOP•3/5/24, 4:40 PM

omg thank you

threekatOP•3/5/24, 4:41 PM

sorry lol

Original message was deleted

Chaika•3/5/24, 4:42 PM

technically from that description it appears that is right if its really strict

Chaika•3/5/24, 4:42 PM

It says its looking for a 301 and a redirect to the https url

Chaika•3/5/24, 4:43 PM

but if you try it yourself, you can see it 302's to a different site (ryder.link)

Chaika•3/5/24, 4:43 PM

it's stupid but not wrong if you take it as face value lol

Chaika•3/5/24, 4:43 PM

security center is broken in a lot of other ways though, I'd just ignore it for now

Unsmart•3/5/24, 4:50 PM

Then you need to upgrade to pay-go and pay $7/user/mo

Chaika•3/5/24, 4:52 PM

I think you could just do Access at 3/user/mo but eitherway prohibitively expensive. It's made to be used by employees, not generic access for users/like a normal signup system

bkyerv•3/5/24, 7:01 PM

who is the best person to report spamming users/bots on this server?

Bbkyerv who is the best person to report spamming users/bots on this server?

Vero•3/5/24, 7:08 PM

Hey, you can DM me

Original message was deleted

DarkDeviL•3/5/24, 7:27 PM

1. Your DMARC record is quite long, and goes over the 255 byte limit, which, depending on the implementation, MAY be able to break the parsing of the record.

;; ANSWER SECTION:
_dmarc.rydercragie.com. 300     IN      TXT     "v=DMARC1; p=reject; sp=reject; rua=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailto:n8dvgnuk@ag.eu.dmarcadvisor.com,mailto:DMARC+RUA@RyderCragie.com; ruf=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailt" "o:n8dvgnuk@fr.eu.dmarcadvisor.com,mailto:DMARC+RUF@RyderCragie.com; fo=0:1:d:s; pct=100; adkim=s; aspf=s"

;; ANSWER SECTION:
_dmarc.rydercragie.com. 300     IN      TXT     "v=DMARC1; p=reject; sp=reject; rua=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailto:n8dvgnuk@ag.eu.dmarcadvisor.com,mailto:DMARC+RUA@RyderCragie.com; ruf=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailt" "o:n8dvgnuk@fr.eu.dmarcadvisor.com,mailto:DMARC+RUF@RyderCragie.com; fo=0:1:d:s; pct=100; adkim=s; aspf=s"

For

without sense for details: It splits within the RUF tag, between Cloudflare and DMARC Advisor.

Such length (and splitting) have been known to cause trouble with some implementations.

2. Your DMARC record does not have

np=reject;

np=reject;

, however, proper implementations should fall back to

p=

p=

for both

sp=

sp=

and

np=

np=

, if they are omitted.
np? -> https://discord.com/channels/595317990191398933/812577823599755274/1214278578842107995

3. Your

mail

mail

is a CNAME, although I highly doubt it, depending on the implementation, a potentially badly coded implementation could maybe be thinking that it should follow the CNAME for the DMARC record.

DarkDeviL•3/5/24, 7:30 PM

Re. first things first, they are also written in the order of how I would be looking at them.

DarkDeviL•3/5/24, 7:31 PM

I am also under the impression that Cloudflare doesn't parse RUF, so yeah, removing that could take a bit off the DMARC record, although, I don't think it will be enough.

DarkDeviL•3/5/24, 7:32 PM

Still splitting, now here:

.com; f" "o=0:1:d:s; pct=100; adkim=s; aspf=s"

.com; f" "o=0:1:d:s; pct=100; adkim=s; aspf=s"

DarkDeviL•3/5/24, 7:32 PM

Can you add forwarders within your Zoho?

DarkDeviL•3/5/24, 7:33 PM

If so, remove DMARC Advisor, and make Zoho forward from your DMARC+RUA and DMARC+RUF to DMARC Advisor.

DarkDeviL•3/5/24, 7:33 PM

(How Zoho works that way, whether it will both deliver to you AND forward, or only just forward, ... is a different story though)

Original message was deleted

DarkDeviL•3/5/24, 7:57 PM

According to the specs, 0 indicates the default, 1 should literally be the same as "d:s", so replacing it with 1 should literally be doing it all.

Original message was deleted

DarkDeviL•3/5/24, 7:57 PM

pct is indeed 100 if omitted, so that can be removed as well.

DarkDeviL•3/5/24, 7:59 PM

And re. sp/np: Some people likes to explicitly be specifying such things (e.g. having them all, even though things should fall back).

DarkDeviL•3/5/24, 7:59 PM

You can leave

p=reject;

p=reject;

, but remove the others (sp/np), if you wish.

DarkDeviL•3/5/24, 8:00 PM

Thing is just, you don't know what kind of broken implementations you may see out there.

DDarkDeviL 1. Your DMARC record is quite long, and goes over the 255 byte limit, which, dep...

DarkDeviL•3/5/24, 8:03 PM

np? -> https://discord.com/channels/595317990191398933/812577823599755274/1214278578842107995

DarkDeviL•3/5/24, 8:04 PM

DNS code 3 (NXDOMAIN).

DarkDeviL•3/5/24, 8:05 PM

p=reject;

p=reject;

alone, if you don't care about being explicit.

DarkDeviL•3/5/24, 8:05 PM

Otherwise

p=reject; sp=reject; np=reject;

p=reject; sp=reject; np=reject;

DarkDeviL•3/5/24, 8:06 PM

The

p=

p=

should be enough according to the specs.

DarkDeviL•3/5/24, 8:06 PM

Exactly.

DarkDeviL•3/5/24, 8:11 PM

adkim/aspf has nothing to do with the p/sp/np policies and their fallback.

DarkDeviL•3/5/24, 8:12 PM

All they control is whether the alignment to the original domain must be exact, or can be a sub-domain thereof.

DarkDeviL•3/5/24, 8:12 PM

The default is r, relaxed.

DarkDeviL•3/5/24, 8:12 PM

If you want them to remain strict, yes, then you need to keep them.

DarkDeviL•3/5/24, 8:14 PM

If you look at the <policy_published></policy_published> sections from the DMARC reports you receive, you will see what the other end claims to see your current DMARC record as.

DarkDeviL•3/5/24, 8:21 PM

That is one sent by Google, right?

DarkDeviL•3/5/24, 8:22 PM

Yep, there you see it.

DarkDeviL•3/5/24, 8:22 PM

Google lists "

np=

np=

", but not

fo=

fo=

DarkDeviL•3/5/24, 8:22 PM

Microsoft lists "

fo=

fo=

", but not

np=

np=

DarkDeviL•3/5/24, 8:23 PM

Point is here the implementations as mentioned above.

DarkDeviL•3/5/24, 8:23 PM

Two different implementations doesn't necessarily do the same.

DarkDeviL•3/5/24, 8:23 PM

DarkDeviL•3/5/24, 8:23 PM

;; ANSWER SECTION: _dmarc.rydercragie.com. 300 IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailto:n8dvgnuk@ag.eu.dmarcadvisor.com,mailto:DMARC+RUA@RyderCragie.com; ruf=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailt" "o:n8dvgnuk@fr.eu.dmarcadvisor.com,mailto:DMARC+RUF@RyderCragie.com; fo=0:1:d:s; pct=100; adkim=s; aspf=s"

why does importing a bind file automatically turn on cloudflare protection? 😭

Similar Threads

Similar Threads

Similar Threads