DnsRecord

Source: src/Cloudflare/Dns/DnsRecord.ts

A single DNS record on a Cloudflare-managed zone.

Safety: when there is no prior state, read scans the zone for an existing (name, type) match. DNS records carry no ownership markers we can inspect, so an existing match is reported as Unowned and the engine refuses to take it over unless --adopt (or adopt(true)) is set. This protects hand-edited records (especially the apex A/AAAA and email DKIM/SPF records that the dashboard often manages) from being clobbered.

Proxied CNAME pointing at a tunnel

yield* Cloudflare.DnsRecord("AdminCname", {
  zoneId: zone.zoneId,
  name: "cluster-admin.example.com",
  type: "CNAME",
  content: `${tunnel.tunnelId}.cfargotunnel.com`,
  proxied: true,
  comment: "research admin UI",
});

Plain A record

yield* Cloudflare.DnsRecord("ApiA", {
  zoneId: zone.zoneId,
  name: "api.example.com",
  type: "A",
  content: "203.0.113.42",
  ttl: 300,
});