Cloudflare DNS Zones & Records
Point a subdomain at a new server, check whether a record is proxied through Cloudflare, or pull a BIND zone file before a migration. Lists your Cloudflare zones with their name servers and status, and reads, adds and edits A, CNAME, MX and TXT records.
Connect this API to an AI agent Browse all specs
What you can do with Cloudflare DNS Zones & Records via MCP
Every endpoint below becomes a governed tool your AI agent (Claude, ChatGPT, or a customer-facing VX agent) can call — with scoped permissions, sandbox testing, and audit logs.
| Method | Path | Operation | Description |
|---|---|---|---|
| GET | /zones |
listZones | List zones (domains) with status and name servers |
| GET | /zones/{zone_id} |
getZone | Get one zone's details, plan and name servers |
| GET | /zones/{zone_id}/dns_records |
listDnsRecords | List or search DNS records in a zone |
| POST | /zones/{zone_id}/dns_records |
createDnsRecord | Add a DNS record (A, AAAA, CNAME, MX, TXT, ...) |
| GET | /zones/{zone_id}/dns_records/{dns_record_id} |
getDnsRecord | Get one DNS record |
| PATCH | /zones/{zone_id}/dns_records/{dns_record_id} |
editDnsRecord | Change fields of a DNS record (content, TTL, proxied) |
| GET | /zones/{zone_id}/dns_records/export |
exportDnsRecords | Export the zone's records as a BIND zone file |
| GET | /zones/{zone_id}/dns_records/usage |
getDnsRecordUsage | Get how many DNS records the zone uses and its quota |
Authentication
api_token
Bearer token — sent as Authorization: Bearer <token>
Cloudflare API token sent as Authorization: Bearer <token>. (Global API keys are not used here.)
How to get a credential
- In the Cloudflare dashboard, open My Profile > API Tokens (dash.cloudflare.com/profile/api-tokens).
- Click Create Token and pick the Edit zone DNS template (or a custom token).
- Under Zone Resources, include only the zones the agent may touch (or all zones in an account).
- Click Continue to summary > Create Token and copy the token; it is shown only once.
Permissions used
| Token permission | Operations |
|---|---|
| Zone > Zone > Read | listZones, getZone |
| Zone > DNS > Read | listDnsRecords, getDnsRecord, exportDnsRecords, getDnsRecordUsage |
| Zone > DNS > Edit | createDnsRecord, editDnsRecord |
The Edit zone DNS template gives DNS Edit only; add Zone > Zone > Read so listZones can find zone ids.
Common errors
- 400 / code 9109 or 10000 Authentication error: token missing, expired or not valid for this zone. Check the zone resources on the token.
- 403 Forbidden: the token lacks DNS Edit (writes) or Zone Read (zone list).
- 400 Bad Request (e.g. code 81057 or 81053): a record with the same name/type already exists, or a CNAME conflicts with another record.
- 429 Too Many Requests: the API allows 1,200 requests per 5 minutes per user; wait and retry.
Store the token as a VX Agents credential so it is never pasted into chat.
Usage guide
Setup
- Add a bearer credential: a Cloudflare API token with Zone > Zone > Read and Zone > DNS > Read (add DNS > Edit for changes), limited to the zones the agent should touch.
- Call
listZonesonce and pin thezone_idof the domain you manage most (32-character hex id).
Check a domain
listZoneswithname=example.comto get the zone id,status(active,pending) and the assignedname_servers.listDnsRecordswithzone_idand filters:type(A,CNAME,MX,TXT, ...),name.exact=shop.example.com,content.contains=1.2.3.4,proxied=true, orsearch. Page withpageandper_page(default 100).getDnsRecordfor one record:content,ttl(1 = automatic),proxied(orange cloud),comment,tags.exportDnsRecordsreturns the whole zone as a BIND text file (good for a backup before changes);getDnsRecordUsageshows how many records the zone uses against its quota.
Change records
Show the user the exact record before and after and wait for confirmation: a wrong DNS change can take a site or email offline.
- Add:
createDnsRecordwithtype,name(e.g.shoporshop.example.com),content(IP, hostname or text),ttl(1 for automatic),proxied(A/AAAA/CNAME only), andpriorityfor MX. CAA and SRV records use adataobject instead ofcontent. - Edit:
editDnsRecordwith only the fields that change, e.g.{"content": "203.0.113.10"}or{"proxied": false}. - Before adding, list records with the same name: a CNAME cannot share a name with any other record.
Good to know
- Every response is wrapped as
{success, errors, messages, result, result_info}; readerrors[].codewhensuccessis false. - SPF, DKIM and DMARC are TXT records; put the value (e.g.
v=spf1 include:_spf.google.com ~all) incontent. - Proxied records always show TTL automatic.
- This spec cannot delete records or zones, import zone files, or make batch changes.
Source: Cloudflare API reference (https://developers.cloudflare.com/api/resources/dns/subresources/records/), checked 2026-10-21.
How to use this spec
- Create a free VX Agents account (sandbox tools included).
- Open the marketplace and connect “Cloudflare DNS Zones & Records” to an agent.
- Expose it as an MCP server for Claude/ChatGPT, or chat with it directly.