Skip to main content
Each division can connect its own Cloudflare account. Its Cloudflare zones then appear under DNS → Zones → Cloudflare and are edited with the same record editor as local zones, including the Proxied toggle and Auto TTL. Changes are written straight to Cloudflare. Connecting needs the integrations.manage permission in the division (Owner by default).

​
Connect a division

1

Create a token on Cloudflare

Under Settings → Integrations, Create token on Cloudflare opens Cloudflare with Zone · Read and DNS · Edit already filled in. Pick the zones the token may access, then Continue to summary → Create Token.Or make one yourself at Cloudflare → API Tokens with the Edit zone DNS template.
2

Paste the token

Paste it into DNZ. DNZ checks it and lists the zones it can reach.
From the terminal:
Right after signing in with Cloudflare, a dialog offers to import the Cloudflare zones into local DNS. You can also do that any time later, see below.

​
Register the OAuth client (superadmin)

1

Create a client on Cloudflare

In Cloudflare: Manage Account → OAuth clients → Create client.
2

Set grant types

Authorization code and Refresh token; token authentication Client secret (or None, for a PKCE-only client).
3

Set the redirect URL

https://dnz.example.com/api/cloudflare/oauth/callback, with your DNZ address. The setup dialog shows the exact URL to copy.
4

Enter the client in DNZ

Paste the client ID and, if any, the secret under Settings → Integrations, or:
New Cloudflare OAuth clients are private: only members of your Cloudflare account can sign in. Make the client public in Cloudflare to let other accounts connect. The client can also be set with DNZ_CLOUDFLARE_OAUTH_CLIENT_ID, DNZ_CLOUDFLARE_OAUTH_CLIENT_SECRET and DNZ_CLOUDFLARE_OAUTH_SCOPES (default zone.read dns.read dns.write offline_access); the dashboard can’t change it then.

​
Copy between Cloudflare and local DNS

Copy to local

Cloudflare → a local zone of the same name (created when missing). Local records already there are kept. Take all records or only the ones you tick.

Push to Cloudflare

Local records that Cloudflare doesn’t have yet → Cloudflare. It only adds; it never changes or deletes anything on Cloudflare.
Both show a preview first: what will be added, what is skipped and why.
Without filters, import takes every record it can. --type and --name (relative to the zone, @ for the apex) narrow it, and zones without matching records are left alone. Copying needs records.write too, and zones.write when a new zone is created. See Import and export for BIND zone files, and the full CLI reference.

​
Other uses