Setup

In order to enable automatic mitigation of random prefix attacks:

1. Set up DNS Firewall.

2. Enable attack mitigation on your DNS Firewall cluster.

   1. In the Cloudflare dashboard, go to the DNS Firewall Clusters page.

      Go to Clusters ↗

   2. Select the cluster you want to update, then select Edit.

   3. Turn on Attack mitigation and choose whether Cloudflare should only mitigate attacks when the upstream is unhealthy.

   4. Select Save.

   Send a PATCH request to update your DNS Firewall cluster:

   Required API token permissions

   At least one of the following token permissions is required:

   • DNS Firewall Write

   curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/dns_firewall/$DNS_FIREWALL_ID" \
   	--request PATCH \
   	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
   	--json '{
   		"attack_mitigation": {
   				"enabled": true,
   				"only_when_upstream_unhealthy": true
   		}
   	}'

Once you turn on attack mitigation, Cloudflare returns a REFUSED response to queries that are part of a random prefix attack.