What the check looks at
F2 resolves common names under your domain (mail, webmail, ftp, cpanel, whm, webdisk, cpcalendars, cpcontacts, autodiscover, autoconfig, smtp, imap, pop, direct, origin, server, dev, staging, test, api, admin, old), plus the bare domain and www. If your zone answers for any made up name (a wildcard record), it checks that answer instead of the list.
Every address that is not Cloudflare’s is compared with what the plugin knows about your server: its outgoing address from the Cloudflare trace and its own public address. An exact match is the server; an address in the same /24 (IPv4) or /64 (IPv6) is close to it.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | No DNS record gives your server away None of the names resolves to your server. |
| PassedConfidence: Medium | Your zone answers for any name, but not with your server A wildcard exists, so names were not listed one by one; it does not point at your server. |
| WarningConfidence: High | A DNS record points straight at your server A record resolves to the exact address of your server. Anybody who looks it up can skip Cloudflare. |
| WarningConfidence: High | A wildcard DNS record gives your server away Any made up name points at your server. |
| WarningConfidence: Medium | A DNS record points close to your server A record resolves to an address on the same network as your server. |
| Could not checkConfidence: Medium | This check could not be completed The group ran out of time; the evidence holds what was checked ( budget). |
| Could not checkConfidence: Low | This check could not be completed The plugin could not learn your server’s public address, or PHP cannot make DNS queries. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
origin_unknown: Edge Doctor could not learn the public address of your server, because the Cloudflare trace did not answer or SERVER_ADDR is not a public address.budget: This group ran out of time before the check finished.php_function_unavailable: A PHP function this check needs is turned off on your server. F2 needsdns_get_record()orgethostbynamel().not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- Nothing visible. The cost shows later: attacks or scrapers that reach the server directly and skip every Cloudflare rule.
Why it happens
A DNS only record “exposes your origin IP address to anyone who queries the record” (Cloudflare: proxy status). Hosting panels create records such as mail, ftp and cpanel on the same server as the website, and they stay DNS only.
With a Tunnel the website has no public entrance, but such records still reveal the machine and whatever else runs on it (Cloudflare: Tunnel).
Confirm it by hand
dig +short mail.example.com
dig +short ftp.example.com
dig +short direct.example.comCompare the answers with your server’s address in the hosting panel.
How to fix it
In Cloudflare: remove records you no longer need, and make web records proxied. Records that cannot be proxied, such as a mail host, are better on a different server or a mail provider.
Then change the server address. An address that was public stays known, so after fixing the records ask your host for a new one, and allow only Cloudflare addresses to the web server if your host supports it.
In WordPress: nothing to change; check F4 covers mail the site sends.
Limitations
Only a fixed list of common names is resolved. A record with an unusual name, or history in public DNS databases, is not seen.
The plugin knows your server by its outgoing and own public address. A server that sends traffic out through a different address can be missed.
Related checks
- F1 Mail host behind the proxy: mail hosts and the proxy.
- F3 Apex and www out of step: a bare domain or www that skips Cloudflare.
- F4 Email revealing your server: mail headers revealing the server.
- B3 Local proxy or Tunnel in front of WordPress: Tunnels.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.