Safety page
The Safety page looks at every zone on the account at once: DNS mistakes, TLS settings and post-quantum readiness, each with its cause and fix.
- Leaked origin IPs: a record that exposes an address behind a proxied name, which lets an attacker bypass Cloudflare.
- Dangling CNAMEs: a CNAME pointing at something that no longer exists, a takeover risk. Service-name records like
_domainconnectaren’t flagged. - CNAME conflicts, mail through the proxy, and SPF / DMARC mistakes.
Encryption mode, minimum TLS version, TLS 1.3 and Always Use HTTPS, each with what’s wrong and the setting that fixes it. “Would Full (strict) work?” does one TLS handshake per origin and says whether its certificate is publicly trusted, a Cloudflare Origin CA certificate, or would fail with a 526, and why.
Post-quantum to the origin
Section titled “Post-quantum to the origin”Cloudflare’s edge already speaks post-quantum to browsers. The hop that matters is Cloudflare to your origin. Cloudflare’s “Automatic key exchange” uses post-quantum to the origin when the origin supports it, so what’s left to check is whether each origin does.
Flarebox runs pqdoctor against the origin addresses in your own proxied DNS records, connecting to the address with the record’s name as SNI. The result is the same report as the CLI: verdict, cause, fix and the ML-DSA check.
- Only on a click, at most 20 origins per run.
- Only your zone’s own origins. Unproxied records, private ranges and placeholder addresses are never probed. Tunnel and Workers CNAMEs aren’t origins and are skipped.
- An origin that refuses connections from here is reported as “not reachable from this machine”, not as a failure. That’s often correct: many origins only accept Cloudflare’s IPs.
From there, each origin’s history lives on the zone’s Post-quantum tab.
Mail servers
Section titled “Mail servers”Each zone also gets one line about the servers that receive its mail, from their last checks: for example “1 of 3 mail servers isn’t post-quantum”, “This zone doesn’t receive mail” or “Explicitly no mail (null MX)”, with a button to the Post-quantum tab. Nothing is checked to build it. See Mail servers (MX).
If an origin requires an Authenticated Origin Pulls certificate that Cloudflare isn’t presenting, Safety lists that too, because the site is down. See Authenticated Origin Pulls.
On a real account
Section titled “On a real account”Safety, DNS and SSL/TLS have been checked against a real account, and their numbers matched the live sites. See What’s proven.