dns/create

Create a new DNS record in a Cloudflare zone.

Proxied vs. Unproxied: Set Proxied: true for web traffic records (A, AAAA, CNAME) to route through Cloudflare CDN and WAF. Set Proxied: false for MX, SRV, bare IP records, and any record that must not be intercepted by Cloudflare.

When to Use

Customer onboarding automation: Provision DNS records for a new subdomain (A, CNAME, TXT) automatically when a new customer account is created.
Domain verification: Add a TXT record for external service verification (Google Search Console, DKIM signing key, Microsoft 365).
Post-provisioning A record: After a new server is provisioned, automatically create an A record pointing the service subdomain to the new IP.
CDN origin CNAME: Create a CNAME pointing a subdomain to a CDN or load balancer hostname after infrastructure setup.
Email service configuration: Set up MX records for a new domain being onboarded to an email platform.

Configuration

Connection

Field	Type	Required	Description
`ApiToken`	string	required	Scoped Cloudflare API Token with `DNS.Edit` permission. Store in BizFirst Credentials Manager.

Operation Fields

Field	Type	Required	Description
`ZoneId`	string	required	32-character hexadecimal Zone ID.
`Type`	string	required	Record type: `A`, `AAAA`, `CNAME`, `MX`, `TXT`, `SRV`, `NS`, or `CAA`.
`Name`	string	required	Record name, e.g., `api.example.com` or `@` for the apex domain.
`Content`	string	required	Record value: IP address for A/AAAA, hostname for CNAME, text for TXT, mail server for MX.
`Ttl`	integer	optional	TTL in seconds. Use `1` for automatic (Cloudflare default). Other values: 60, 120, 300, 600, 900, 1800, 3600, 7200, 18000, 43200, 86400.
`Proxied`	boolean	optional	Route through Cloudflare proxy. Default: `false`. Set `true` for A/AAAA/CNAME records that should use CDN/WAF.
`Priority`	integer	optional	Priority for MX and SRV records. Lower values are higher priority.

Sample Configuration

{
  "resource": "dns",
  "operation": "create",
  "connection": {
    "ApiToken": "{{ $credentials.cloudflare_dns_edit }}"
  },
  "ZoneId": "023e105f4ecef8ad9ca31a8372d0c353",
  "Type": "A",
  "Name": "api.example.com",
  "Content": "198.51.100.4",
  "Ttl": 1,
  "Proxied": true
}

Validation Errors

Code	Condition	Resolution
`MISSING_API_TOKEN`	ApiToken is empty	Set the ApiToken credential with DNS.Edit permission
`MISSING_ZONE_ID`	ZoneId is empty	Provide the Zone ID
`MISSING_TYPE`	Type field is empty	Specify a valid record type (A, CNAME, MX, TXT, etc.)
`MISSING_NAME`	Name field is empty	Provide the fully-qualified record name or `@`
`MISSING_CONTENT`	Content field is empty	Provide the record value (IP, hostname, or text)
`UNKNOWN_ERROR`	Duplicate record or invalid content for type	Check if the record already exists with dns/list

Output

Success Port

Field	Type	Description
`id`	string	UUID of the newly created record — save for future dns/update and dns/delete calls
`type`	string	Record type as created
`name`	string	Fully-qualified record name
`content`	string	Record value
`ttl`	integer	Effective TTL
`proxied`	boolean	Proxy status
`createdOn`	string	ISO 8601 creation timestamp

Error Port

On failure, the error port receives an object with code and message.

Sample Output

{
  "id": "372e67954025e0ba6aaa6d586b9e0b59",
  "type": "A",
  "name": "api.example.com",
  "content": "198.51.100.4",
  "ttl": 1,
  "proxied": true,
  "createdOn": "2026-05-26T12:00:00Z"
}

Expression Reference

Expression	Returns
`{{ $node.DnsCreate.output.id }}`	New record UUID — persist for future operations
`{{ $node.DnsCreate.output.name }}`	Created record name
`{{ $node.DnsCreate.output.content }}`	Created record value
`{{ $node.DnsCreate.output.proxied }}`	Boolean proxy status of new record
`{{ $node.DnsCreate.output.createdOn }}`	Creation timestamp

Node Policies & GuardRails

Policy	Detail
Require DNS.Edit token	Creation requires write permission — a read-only token will fail with a 403
Store ApiToken in Credentials Manager	Never hardcode the token in configuration JSON
Persist the returned record ID	Store the new record's `id` in a workflow variable — it is needed for future update and delete operations
Do not proxy MX or SRV records	MX, SRV, and NS records cannot be proxied — set `Proxied: false` for these types
Validate content format per type	A records require valid IPv4, AAAA requires IPv6, CNAME requires a valid hostname — validate before calling
Check for duplicates first	Cloudflare rejects duplicate records — call dns/list to check for existing records with the same name and type before creating

Examples

Example 1: Automated Subdomain Provisioning on Customer Signup

Trigger: new customer record created in the database. Workflow: (1) Generate subdomain name from customer slug. (2) Call dns/create with Type: "CNAME", Name: "{slug}.example.com", Content: "app.example.com", Proxied: true. (3) Store the returned record ID in the customer record for future cleanup.

Example 2: DKIM TXT Record Creation

When onboarding a domain to an email service, call dns/create with Type: "TXT", Name: "selector._domainkey.example.com", and Content: "v=DKIM1; k=rsa; p=...". Set Proxied: false (TXT records cannot be proxied).

Example 3: Post-Server-Provisioning A Record

After a Docker or cloud provisioning workflow creates a new server and retrieves its IP, call dns/create with Type: "A", Name: "node-{id}.example.com", and Content: "{serverIp}". This makes the new node immediately resolvable.