> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare DNS Zone

> Manage a Cloudflare DNS zone for a domain you already own (with an optional DNS record) via the Cloudflare Terraform provider

Qovery creates it in your account with a third-party provider, using credentials you enter in the form, as a [Blueprint](https://www.qovery.com/docs/configuration/blueprints.md) service in one of your environments.

| | |
| - | - |
| Catalog name | `cloudflare-dns-zone` |
| Category | Networking & Edge |
| Provider | EXTERNAL |
| Engine | terraform |
| Major versions (latest release) | `default` (1.0.7) |
| Source | [EXTERNAL/cloudflare-dns-zone/default](https://github.com/Qovery/service-catalog/tree/EXTERNAL/cloudflare-dns-zone/default/1.0.7/EXTERNAL/cloudflare-dns-zone/default) |

> [!TIP]
>
> **New to this?** You don't need to know Terraform or Kubernetes. Qovery sets up Cloudflare DNS Zone in your account with the provider: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

## Create it

> [tab] Console
>
> 1. Open the environment, then **New service** › **Blueprint**.
> 2. Find **Cloudflare DNS Zone** in the catalog and pick the major version.
> 3. Fill in the variables. Required ones are marked; the others use their defaults.
> 4. Create the service, and deploy it now or later.

> [tab] CLI and API
>
> List the catalog to get the latest tag, then create the service from it. `qovery api` signs the requests with your CLI session.
>
> ```bash theme={null}
> ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
> ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"
>
> qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "cloudflare-dns-zone")'
>
> cat > blueprint.json <<'EOF'
> {
>   "name": "cloudflare-dns-zone",
>   "tag": "EXTERNAL/cloudflare-dns-zone/default/1.0.7",
>   "icon": "app://qovery-console/cloudflare",
>   "variables": [
>     {
>       "name": "cloudflare_api_token",
>       "value": "REPLACE_WITH_CLOUDFLARE_API_TOKEN",
>       "is_secret": true
>     },
>     {
>       "name": "account_id",
>       "value": "REPLACE_WITH_ACCOUNT_ID"
>     },
>     {
>       "name": "zone_name",
>       "value": "REPLACE_WITH_ZONE_NAME"
>     }
>   ],
>   "spec_overrides": {
>     "engine_version": "1.9.7"
>   }
> }
> EOF
> BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
> rm blueprint.json   # it can hold secret values
> qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
> qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment
> ```
>
> Replace each `REPLACE_WITH_` value. Add optional variables to `variables` the same way.

> [tab] Coding agent
>
> Paste this into Claude Code, Cursor, Codex or another coding agent with the [Qovery agent skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) installed (`curl -fsSL https://skill.qovery.com/install.sh | bash`).
>
> ```text Prompt wrap theme={null}
> Add the Qovery Blueprint Cloudflare DNS Zone (cloudflare-dns-zone) to one of my Qovery environments and deploy it. Ask me for cloudflare_api_token, account_id and zone_name.
> Ask me before deploying to a production environment.
> Docs: https://www.qovery.com/docs/configuration/blueprints/cloudflare-dns-zone.md
> ```

You don't add any file to your repository. Qovery creates the Blueprint from the Console or the API.

## Variables and outputs

Generated from `qbm.yml` at `EXTERNAL/cloudflare-dns-zone/default/1.0.7`, the manifest the Console form is built from.

> [accordion] All 9 variables
>
> | Name | Type | Required | Default | Secret | Description |
> | - | - | - | - | - | - |
> | `cloudflare_api_token` | string | Yes | | Yes | Needs Zone edit, plus account-level zone create permission |
> | `account_id` | string | Yes | | | Cloudflare account ID that will own the zone |
> | `zone_name` | string | Yes | | | Domain to manage (e.g. example.com). Must already be registered; this manages its DNS zone, it does not register it. |
> | `zone_type` | string | | `full` | | Zone setup type |
> | `record_name` | string | | | | Empty = create no record. Else www, @, or a full host. |
> | `record_type` | string | | `A` | | DNS record type |
> | `record_content` | string | | | | DNS record value (IP, hostname, or text). Required when record\_name is set. |
> | `record_ttl` | number | | `1` | | DNS record TTL in seconds (1 = automatic). Must be 1 when record\_proxied is true. |
> | `record_proxied` | bool | | `false` | | Whether the record is proxied through Cloudflare (orange cloud). Only valid for A/AAAA/CNAME. |

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint's name; see [Aliases Qovery creates for outputs](https://www.qovery.com/docs/configuration/environment-variables.md#aliases-qovery-creates-for-outputs) for the naming rules and the cases where no alias is created.

> [accordion] All 6 outputs
>
> | Name | Secret | Description |
> | - | - | - |
> | `zone_id` | | Cloudflare zone ID |
> | `zone_name` | | Managed domain name |
> | `name_servers` | | Cloudflare-assigned name servers to set at your registrar (full zones only) |
> | `status` | | Zone activation status |
> | `verification_key` | | TXT verification value for partial (CNAME) setups |
> | `record_id` | | Created DNS record ID (empty when no record is configured) |

> [!WARNING]
>
> Secret variables and outputs are encrypted and masked in Qovery, but Terraform can also keep their values, and values derived from them, in its state. With the Qovery-managed state backend (the default), Qovery stores the state. If you use your own backend, protect it and keep state files out of version control.

## Reference

From the Blueprint's [README](https://github.com/Qovery/service-catalog/blob/EXTERNAL/cloudflare-dns-zone/default/1.0.7/EXTERNAL/cloudflare-dns-zone/default/README.md).

Manages a [Cloudflare DNS zone](https://developers.cloudflare.com/dns/zone-setups/) (`cloudflare_zone`) for a domain you already own, with an optional DNS record (`cloudflare_dns_record`), via the official `cloudflare/cloudflare` provider (`~> 5.0`).

> **This manages a DNS zone; it does not register domains.** The domain must already be registered (anywhere). For a `full` zone, point your registrar's name servers at the `name_servers` output. Cloudflare Registrar cannot purchase new domains via Terraform.

### Credentials

A **Cloudflare API token** supplied as the sensitive `cloudflare_api_token` variable (`credentials.default: env`). Needs *Zone: Edit* plus account-level permission to create zones.

### Variables

#### Required

| Name | Type | Sensitive | Description |
| - | - | - | - |
| `cloudflare_api_token` | string | yes | Cloudflare API token with Zone edit permission (and account-level zone create permission) |
| `account_id` | string | | Cloudflare account ID that will own the zone |
| `zone_name` | string | | Domain to manage (e.g. `example.com`) |

#### Optional

| Name | Type | Default | Description |
| - | - | - | - |
| `zone_type` | string | `full` | Zone setup type: full (Cloudflare hosts DNS) or partial (CNAME/partner setup) |
| `record_name` | string | | Optional DNS record name (e.g. www, @, or a full host). Empty = create no record. |
| `record_type` | string | `A` | `A`, `AAAA`, `CNAME`, `TXT`, `MX`, `NS` |
| `record_content` | string | | Record value. Required when `record_name` is set. |
| `record_ttl` | number | `1` | TTL seconds (`1` = automatic; must be `1` when proxied) |
| `record_proxied` | bool | `false` | Proxy through Cloudflare (orange cloud). A/AAAA/CNAME only. |

### Outputs

| Name | Description |
| - | - |
| `zone_id` | Cloudflare zone ID |
| `zone_name` | Managed domain name |
| `name_servers` | Cloudflare name servers to set at your registrar (full zones only) |
| `status` | Zone activation status |
| `verification_key` | TXT verification value for partial (CNAME) setups |
| `record_id` | Created DNS record ID (empty when no record is configured) |


## Related topics

- [Blueprints](https://www.qovery.com/docs/configuration/blueprints.md)
- [Clusters](https://www.qovery.com/docs/configuration/clusters.md)
- [Edit cluster DNS provider](https://www.qovery.com/docs/api-reference/clusters/edit-cluster-dns-provider.md)
- [Cloudflare Workers](https://www.qovery.com/docs/configuration/blueprints/cloudflare-workers.md)
- [Get cluster DNS provider](https://www.qovery.com/docs/api-reference/clusters/get-cluster-dns-provider.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.