Id caution against using Cloudflare for DNS. They rewrite your CAA record so multiple other CAs can sign certs on your domains. It's non-obvious unless you query your own CAA record

▲

indigodaddy 3 hours ago | parent [-]

Source/writeup somewhere? The amount of domains that use CF must be staggering, so if this was a real threat being leveraged in the wild you'd think it would be an epidemic no??

▲

kbolino 3 hours ago | parent | next [-]

It's not a threat.

Most websites don't use CAA records at all. The records can only narrow what CAs are acceptable down from the end user's root trust store, they can't add new CAs to it. And CloudFlare is typically in charge of managing its customers' certificates, so they add CAA records for their own CAs.

If you don't trust CF to manage your certs, you are not in their target market and generally should not use their products.

https://developers.cloudflare.com/ssl/reference/certificate-...

▲

yurishimo 3 hours ago | parent | prev [-]

Many people use cloudflare for DNS. Few people use cloudflare for domain name purchases as that feature is much newer.

	▲	indigodaddy 3 hours ago \| parent \| next [-]
		OP specifically said "using Cloudflare for DNS..." ? I wasn't talking about domain name registration and don't think OP was either?
	▲	dv_dt 2 hours ago \| parent \| prev [-]
		Well and dns service is reasonably easy to switch