Cloudflare DNS Skill

Language

Match user's language: Respond in the same language the user uses.

Overview

Manage Cloudflare DNS records via REST API. Covers record CRUD, proxy settings, troubleshooting, and Kubernetes External-DNS integration.

Script Directory

Determine this SKILL.md directory as SKILLDIR, then use ${SKILLDIR}/scripts/cloudflare-dns.sh.

Environment

Credentials are loaded automatically from .env files. The script checks in this order (highest priority first):

1. Environment variables (already set in shell — always win)
2. Project-level <cwd>/.env (auto-loaded by script)
3. Skill-level ${SKILL_DIR}/.env (auto-loaded by script)

First-time Setup

When running preflight and credentials are missing, guide the user:

Cloudflare API credentials not found.

How to obtain:
1. Visit https://dash.cloudflare.com/profile/api-tokens
2. Create Custom Token with permissions: Zone:Read + DNS:Edit
3. Scope to specific zones (recommended)
4. Copy the token

Where to save?
A) Project-level: <cwd>/.env (this project only)
B) User-level: ${SKILL_DIR}/.env (all projects using this skill)

After the user chooses, check if a .env already exists at the target location:

• If it exists: show the current contents, ask the user — (A) Append CF_* keys to existing file, (B) Backup and replace (cp .env .env.backup.$(date +%s)), or (C) Skip
• If it does not exist: copy .env.example to .env

Then fill in the values:

CF_API_TOKEN=<user_input>
CF_ZONE_ID=<user_input_optional>

Preflight Check-Fix Table

When preflight reports ready: false, use this table to resolve each failure:

Workflow

1. Preflight — Verify credentials and tools:

``bash bash ${SKILL_DIR}/scripts/cloudflare-dns.sh preflight ` If ready: false`, consult the Check-Fix Table above for specific remediation.

1. List existing records — Understand current state before changes:

``bash bash ${SKILL_DIR}/scripts/cloudflare-dns.sh list-records ``

1. Create / update / delete records as needed:

``bash bash ${SKILLDIR}/scripts/cloudflare-dns.sh create-cname $CFZONEID www target.example.com true bash ${SKILLDIR}/scripts/cloudflare-dns.sh create-a $CFZONEID app 1.2.3.4 true ``

1. Verify DNS propagation:

``bash bash ${SKILL_DIR}/scripts/cloudflare-dns.sh verify-dns app.example.com ``

For raw curl commands, read references/dns-operations.md.

Script Reference

Helper script: scripts/cloudflare-dns.sh

Degradation

Core DNS record operations (list, create, update, delete) only require curl and jq.

Completion Report

After any mutation operation (create, update, delete), present a structured report:

DNS Record Updated!

Zone: [zone name] ([zone_id])
Operation: [create | update | delete]
Record: [type] [name] → [content]
Proxied: [yes | no]
TTL: [value]

Verification:
✓ API returned success
✓ dig @1.1.1.1 [name] [type] → [resolved value]  (if dig available)

Next Steps:
→ Full propagation may take 1-5 minutes
→ Verify with: dig @1.1.1.1 [name] [type]

For delete operations, omit the content/proxied/TTL fields and adjust accordingly.

Proxy Decision Guide

Troubleshooting

Security

1. Scope tokens — Use specific zones, not "All zones"
2. IP filtering — Restrict to known IPs when possible
3. Rotate regularly — Every 90 days for production
4. Store in .env — Never hardcode tokens in scripts or SKILL.md

References

Read these on demand when the user's request needs deeper context. Do not load all at once.