Overview
Concepts
Zone setups
Full setup
Setup
Troubleshooting
Partial (CNAME) setup
Setup
Convert to full setup
DNS resolution
DNS Zone transfers
Cloudflare as Primary
Setup
Cloudflare as Secondary
Setup
Proxy traffic
DNSSEC options
Access Control Lists (ACLs)
Cloudflare IP addresses
Create ACL
Troubleshooting
Subdomain setup
Setup
Enable DNSSEC
Migrate to new account
Rollback
Reference
Nameserver assignment
Records quick scan
Zone status
Troubleshooting
Cannot add domain
Delete all DNS records
Domain deleted from Cloudflare
Zone removal
DNS records
How to
Manage DNS records
Import and export records
Create zone apex record
Create subdomain records
Set up email records
Dynamically update DNS records
Round-robin DNS
Delegating Subdomains
Reference
Proxy status
DNS record types
Time to Live (TTL)
Record attributes
Wildcard DNS records
Vendor-specific DNS records
Troubleshooting
Records with the same name
Exposed IP addresses
Verify a domain with CNAME
NS records already exist
DNSSEC
Multi-signer DNSSEC
About
Setup
DNSSEC states
Migration tutorial
Troubleshooting
CNAME flattening
Setup
Example diagram
Additional options
Custom nameservers
Zone level
Account level
Tenant level
Analytics and logs
Reverse zones and PTR records
DNS Firewall
Setup
Analytics
FAQ
Random prefix attack mitigation
About
Setup
Reference
Analytics API properties
Recommended third-party tools
Features and plans
Domain Connect
Troubleshooting
General FAQ
DNS_PROBE_FINISHED_NXDOMAIN
DNS_PROBE_POSSIBLE
Email issues
General DNS issues
Glossary

Access Control Lists (ACLs)

Access Control Lists (ACLs) define allowed source IP addresses from where servers accept incoming data or control messages.

When setting up new DNS zone transfers (incoming or outgoing), you will need to update the ACL at your other DNS provider(s) to allow Cloudflare to communicate with their server(s). You can find the Cloudflare IP addresses you need to allow at your other DNS provider(s) at Cloudflare IP addresses.

You need to create a new ACL in your Cloudflare account in the following situations if you want to specify additional NOTIFY IPs that Cloudflare should listen to (Cloudflare as secondary) or additional IPs Cloudflare should accept zone transfer requests from (Cloudflare as primary).