Create your first DNS policy
DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP.
You can filter DNS traffic based on query or response parameters (such as domain, source IP, or geolocation). You can also filter by user identity if you connect your devices to Gateway with the WARP client or Cloudflare One Agent.
To create a new DNS policy:
- In Zero Trust ↗, go to Gateway > Firewall policies.
- In the DNS tab, select Add a policy.
- Name the policy.
- Under Traffic, build a logical expression that defines the traffic you want to allow or block.
- Choose an Action to take when traffic matches the logical expression. For example, we recommend adding a policy to block all security categories:
Selector Operator Value Action Security Categories in All security risks Block - Select Create policy.
-
Create an API token with the following permissions:
Type Item Permission Account Zero Trust Edit -
(Optional) Configure your API environment variables to include your account ID and API token.
-
Send a
POSTrequest to the Create a Zero Trust Gateway rule endpoint. For example, we recommend adding a policy to block all security categories:curl API DNS policy example curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \--header "Content-Type: application/json" \--header "Authorization: Bearer <API_TOKEN>" \--data '{"name": "Block security risks","description": "Block all default Cloudflare DNS security categories","precedence": 0,"enabled": true,"action": "block","filters": ["dns"],"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})","identity": "","device_posture": ""}'{"success": true,"errors": [],"messages": []}The API will respond with a summary of the policy and the result of your request.
For more information, refer to DNS policies.