Setup

In order to enable automatic mitigation of random prefix attacks:

1. Set up DNS Firewall.

2. Enable attack mitigation on your DNS Firewall cluster.

   Dashboard

   1. In the Cloudflare dashboard, go to the DNS Firewall Clusters page.

      Go to Clusters

   2. Select the cluster you want to update, then select Edit.

   3. Turn on Attack mitigation and choose whether Cloudflare should only mitigate attacks when the upstream is unhealthy.

   4. Select Save.

   API

   Send a PATCH request to update your DNS Firewall cluster:

   Required API token permissions

   At least one of the following token permissions is required:

   • DNS Firewall Write

   Update DNS Firewall Cluster

   curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/dns_firewall/$DNS_FIREWALL_ID" \
     --request PATCH \
     --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     --json '{
       "attack_mitigation": {
           "enabled": true,
           "only_when_upstream_unhealthy": true
       }
     }'

Once you turn on attack mitigation, Cloudflare returns a REFUSED response to queries that are part of a random prefix attack.

Note

If you do not specify otherwise, Cloudflare automatically sets the only_when_upstream_unhealthy parameter to true, which means that Cloudflare will only mitigate attacks when we detect that the upstream is unresponsive (possibly as a result of an attack).