Find the stale DNS record across nine zones in one pass

Find the stale DNS record across your zones

The companion lists accounts first, because every account-scoped tool needs the account id and copying it out of the dashboard is a step it can take itself. Then zones, then DNS records filtered to the types that could explain the symptom, then the one specific setting rather than the all-settings endpoint.

Twenty minutes of tab-switching collapses into a paragraph naming the record, the two zones that share the stale target and the 11:04 purge. That paragraph is what you send to the person waiting.

What can a companion reach in Cloudflare?

Zones, settings, DNS, Workers, Pages, KV and R2, all read in a single pass.

Workers list and a single script fetches by name; Pages projects come back with their build config, source and production branch. That answers "what is deployed where" across an account in one go.

Storage is discovery: KV namespaces and R2 buckets are listable, their keys, values and objects are not. Every zone setting is readable, so a companion can tell you Always Use HTTPS is off, and the switch stays a human one. Firewall rules, WAF, page rules, Access policies, certificates and analytics have no tools here.

• Zones: list, get, read a single setting or the deprecated all-settings set. No setting is writable.
• DNS: list with filters, create, update, delete. The entire write half of the surface.
• Workers and Pages: list and get, including build configuration. Nothing deploys.
• Storage: KV namespaces and R2 buckets can be listed; their contents cannot be reached.

What happens before a DNS record changes?

Two gates, protecting different mistakes.

The token itself must carry Zone.DNS:Edit, which is a decision you make when you mint it and can decline. Then the call asks for an explicit confirmation naming the record before it executes, the same approval step every consequential companion action goes through.

Purging has the same shape with a different edge. Purging everything is blunt on a busy zone, and the surgical alternatives, by cache tag or by host, are Enterprise features. On most plans the choices are everything or an explicit list of files, and a companion states which one it is about to do before it does it.

Get the outage write-up, not a record list

A misconfigured zone is rarely the whole story. The deployment that changed lives in another dashboard, the ticket is in your tracker, and the person waiting wants prose rather than a record list. A companion reads across the accounts you are signed into and writes the finding, which is operations work.

On a schedule the same pass becomes a weekly audit: which zones point at hosts that no longer resolve, which Pages projects have not built in a month, delivered as a reviewable table. That is ordinary data extraction once the reading is automatic. Cloudflare publishes its own MCP servers and a dashboard assistant, as of this writing, and Wrangler stays where publishing, KV writes and secrets live.

Frequently asked questions