How a query is answered
Every query, over UDP, TCP or encrypted DNS, takes the same path:- Local zones are answered first and are never blocked. A zone can be the whole truth for its domain, or override only a few names and forward the rest.
- Filtering blocks names on a blocklist or a response policy zone, unless an allow rule says otherwise, and can answer search engines with their safe variant. See Filtering.
- Conditional forwarding rules send a domain, or every name some clients ask for, to other servers. See Forwarding.
- The cache answers what was asked recently, honoring TTLs.
- Everything else goes to the upstreams, using the forwarding strategy you picked.
Local, forwarded and secondary zones
Cloudflare zones are only managed through DNZ; DNZ does not answer queries for them unless you copy
them into a local zone. See Cloudflare.
Divisions
A division is a part of your organization, such as a department or a site. Every zone belongs to exactly one division, and users only see the divisions they’re assigned to. Divisions also own their API tokens, DNS update keys, Cloudflare connection and blocklists. The division a client device belongs to, for per-division filtering, is picked by its IP address: a superadmin maps client networks to divisions.Roles and permissions
Users get a role per division. A role is a set of permissions:
Built-in roles are Owner (everything), Editor (zones, records, logs) and Viewer
(read-only). You can add your own.
Superadmins stand above divisions: they have full access everywhere and are the only ones who
manage users, roles, divisions, forwarding, server-wide filtering, views, replication, proxies,
notifications and server settings. See Users, divisions and roles.
Three ways to manage DNZ
The dashboard, thednz CLI and the HTTP API all go through the
same API, so they follow the same permissions and validation, and every change lands in the
audit log under the person who made it.