Cloudflare WAF, DNSSEC and CAA: what to actually switch on

Moving a domain to Cloudflare takes about ten minutes, which is exactly why so many domains sit there half configured. The easy parts get done on the day. The parts that need judgement, and that break things if you do them in the wrong order, get postponed and then forgotten.

This is what is actually worth switching on, and what the free tier already covers.

The Cloudflare WAF: what it is and is not

Cloudflare’s Web Application Firewall inspects requests before they reach your origin and blocks the ones matching a rule. Managed rulesets cover the well-known categories: SQL injection, cross site scripting, and the exploit of the month.

Two things surprise people.

The default ruleset is not tuned to you. It is tuned to the average of everyone. Out of the box it blocks very little that a targeted attacker would try against your specific application, and it occasionally blocks a legitimate customer whose request looks unusual. A firewall nobody has looked at since setup is closer to decoration than defence.

Rate limiting is usually the higher-value control, and it is the one most often left off. Your login endpoint and your contact form are the two things bots hammer, and rate limiting is a far blunter, more reliable answer than pattern matching. If you switch on one thing today, make it a rate limit on /login and on whatever handles your forms.

Run new rules in log-only mode first. Every rule you add should spend a week telling you what it would have blocked before it is allowed to block anything. This is the single habit that separates a firewall that helps from one that quietly costs you customers.

DNSSEC: the order is the whole job

DNSSEC signs your DNS answers so a resolver can verify they genuinely came from you, rather than being forged in transit. Without it, someone positioned between your customer and DNS can point your domain elsewhere, and the browser shows no warning at all, because as far as it knows it went where DNS told it to.

Switching it on is one toggle at Cloudflare. The risk is not difficulty, it is sequence.

There are two systems involved: your DNS provider, which signs the zone, and your registrar, which publishes a DS record at the registry vouching for the signing key. If those two ever disagree, validating resolvers conclude the answers are forged and return nothing. Your domain stops resolving — website and email together.

The correct order:

1. Sign the zone at your DNS provider.
2. Confirm it has propagated. Do not skip this.
3. Publish the DS record at the registrar.

Reverse it and you publish a key fingerprint for signatures that do not exist yet, and the domain goes dark. The same care applies backwards: to turn DNSSEC off, remove the DS record first, wait, then unsign.

The most common real-world outage is not enabling it at all — it is changing DNS provider on a signed domain and forgetting the keys change with it. What DNSSEC is covers the chain of trust in more detail.

Worth calibrating expectations: DNSSEC adoption among large brands is still low. Of the twelve biggest consumer brands we checked, only PayPal signs. It is a genuine improvement, not an emergency, and it belongs after your email records are sorted.

CAA: one line, and almost free

Without a CAA record, any publicly trusted certificate authority can issue an HTTPS certificate for your domain — not just the one you use. A CAA record names the ones permitted.

yourcompany.com.  CAA  0 issue "letsencrypt.org"
yourcompany.com.  CAA  0 issuewild "letsencrypt.org"
yourcompany.com.  CAA  0 iodef "mailto:security@yourcompany.com"

Add the iodef line and you also get told when somebody attempts issuance you did not authorise — which is otherwise completely invisible to you. Account for everything that issues on your behalf first: your CDN, hosting panel, load balancer and mail provider may each use a different CA. The CAA record explained covers the detail.

Do you need a paid plan?

Often not, and it is worth saying plainly because plenty of people are told otherwise.

DNSSEC, CAA and the basic firewall rules are free. Rate limiting has a usable free allowance. The paid tiers buy you managed rulesets, more granular controls, bot management and better analytics — genuinely useful at scale, and unnecessary for a business running one site and a handful of forms.

We earn nothing from your Cloudflare bill, so our advice is uncomplicated: start on free, and move up only when you can name the specific control you need.

A sensible order of work

1. Email records first. SPF, DKIM, DMARC. This is where impersonation actually happens, and it is where your money is. See SPF, DKIM and DMARC explained.
2. CAA. Minutes of work, free, closes off certificate issuance.
3. Rate limiting on login and form endpoints.
4. WAF rules, in log-only mode, reviewed after a week.
5. DNSSEC, sequenced carefully, once everything above is stable.

Most people do this list backwards, starting with the firewall because it feels like security, and never reaching the email records that decide whether someone can invoice their customers in their name.

Check where your domain stands in about twenty seconds with the free domain security checker — it grades DNSSEC and CAA along with your email records. If you would rather we did the work, it is part of our domain and email security engagement; Cloudflare is tooling we use, not a separate product we sell.