Servers outside the CDN

A CDN protects a site only when every name goes through it.

What it is

Your main name goes through Cloudflare, while another name in your domain answers with the address of your own server.

Why it matters

Anyone who learns the server address can reach it around the CDN, its firewall and its rate limits. Attackers look for such names to find the origin.

How Tenty checks it

Tenty resolves the names of your certificate. When the main site goes through Cloudflare and another name resolves to an address outside the Cloudflare ranges, it reports the name and the address. The finding is marked likely.

How to fix it

Turn on the proxy for the record in Cloudflare DNS, or close the direct address of the server and allow only Cloudflare ranges on it.

How to reproduce

dig +short A YOUR-SUBDOMAIN

An address outside the Cloudflare ranges is the one in the finding.