CNAME coexists with another record type at same name

dig +noall +answer CNAME app.example.com
dig +noall +answer A app.example.com
dig +noall +answer MX app.example.com
dig +noall +answer TXT app.example.com

# one shot against a public resolver (ANY is often throttled)
dig +noall +answer ANY app.example.com @8.8.8.8

# more reliable: trace straight to the authoritative nameservers
dig +trace app.example.com

# BEFORE (conflict): both records exist at the same name
www.example.com.    CNAME   www.example.com.cdn.example.net.
www.example.com.    TXT     "v=spf1 include:_spf.example.com ~all"

# AFTER, option 1: keep the CNAME, move the TXT off that name
www.example.com.    CNAME   www.example.com.cdn.example.net.
_spf-check.example.com.  TXT   "v=spf1 include:_spf.example.com ~all"

# AFTER, option 2: keep the TXT, replace the CNAME with an A record
sub.example.com.     A     203.0.113.10
sub.example.com.     TXT   "v=spf1 include:_spf.example.com ~all"

# delete the conflicting record (the TXT, A, or MX id you are removing)
curl -s -X DELETE \
  "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records/$RECORD_ID" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

# optionally add back a needed record type under a non-aliased name
curl -s -X POST \
  "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"type":"A","name":"sub.example.com","content":"203.0.113.10","ttl":300}'

# the removed type should now be empty, the kept type should resolve
dig +noall +answer CNAME sub.example.com
dig +noall +answer TXT sub.example.com

# full answer section should show exactly one RRset for this name
dig sub.example.com

# if mail was involved, confirm MX and TXT are reachable
dig +short MX example.com
dig +short TXT sub.example.com

# re-pull the zone and confirm no name groups CNAME with another type
curl -s "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" | jq '[.result[] | {name, type}]'

"""Find CNAME coexistence violations in a Cloudflare zone and optionally fix them.
Run whenever you want to audit a zone. Safe to run again and again.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("cname_coexistence")

DRY_RUN = os.environ.get("DRY_RUN", "true").lower() == "true"


def find_cname_coexistence_violations(records):
    """Pure, no I/O. records: list of {"name": str, "type": str, "id": str}.
    Returns a list of {"name": str, "conflicting_ids": list[str], "types": list[str]}.
    """
    groups = {}
    for rec in records:
        key = rec["name"].lower()
        groups.setdefault(key, []).append(rec)

    violations = []
    for name, group in groups.items():
        has_cname = any(r["type"] == "CNAME" for r in group)
        if has_cname and len(group) > 1:
            others = [r for r in group if r["type"] != "CNAME"]
            violations.append({
                "name": name,
                "conflicting_ids": [r["id"] for r in others],
                "types": [r["type"] for r in others],
            })
    return violations


def run():
    import requests  # imported lazily so the pure function has no dependency at import time

    token = os.environ["CLOUDFLARE_API_TOKEN"]
    zone_id = os.environ["CLOUDFLARE_ZONE_ID"]
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

    r = requests.get(
        f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
        headers=headers, params={"per_page": 5000}, timeout=30,
    )
    r.raise_for_status()
    records = [
        {"name": rec["name"], "type": rec["type"], "id": rec["id"]}
        for rec in r.json()["result"]
    ]

    violations = find_cname_coexistence_violations(records)
    if not violations:
        log.info("No CNAME coexistence violations found.")
        return

    for v in violations:
        log.warning(
            "%s has a CNAME plus %s (%d record(s) to remove or relocate)",
            v["name"], ", ".join(v["types"]), len(v["conflicting_ids"]),
        )
        for record_id in v["conflicting_ids"]:
            if DRY_RUN:
                log.info("Would delete record %s at %s", record_id, v["name"])
                continue
            del_r = requests.delete(
                f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}",
                headers=headers, timeout=30,
            )
            del_r.raise_for_status()
            log.info("Deleted record %s at %s", record_id, v["name"])

    log.info("Done. %d name(s) had a conflict.", len(violations))


if __name__ == "__main__":
    run()

/**
 * Find CNAME coexistence violations in a Cloudflare zone and optionally fix them.
 * Run whenever you want to audit a zone. Safe to run again and again.
 */
const DRY_RUN = (process.env.DRY_RUN || "true").toLowerCase() === "true";

export function findCnameCoexistenceViolations(records) {
  // Pure, no I/O. records: array of { name, type, id }.
  // Returns array of { name, conflictingIds, types }.
  const groups = new Map();
  for (const rec of records) {
    const key = rec.name.toLowerCase();
    if (!groups.has(key)) groups.set(key, []);
    groups.get(key).push(rec);
  }

  const violations = [];
  for (const [name, group] of groups) {
    const hasCname = group.some((r) => r.type === "CNAME");
    if (hasCname && group.length > 1) {
      const others = group.filter((r) => r.type !== "CNAME");
      violations.push({
        name,
        conflictingIds: others.map((r) => r.id),
        types: others.map((r) => r.type),
      });
    }
  }
  return violations;
}

async function run() {
  const token = process.env.CLOUDFLARE_API_TOKEN;
  const zoneId = process.env.CLOUDFLARE_ZONE_ID;
  const headers = { Authorization: `Bearer ${token}`, "Content-Type": "application/json" };

  const listRes = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records?per_page=5000`,
    { headers },
  );
  if (!listRes.ok) throw new Error(`Cloudflare list returned ${listRes.status}`);
  const body = await listRes.json();
  const records = body.result.map((rec) => ({ name: rec.name, type: rec.type, id: rec.id }));

  const violations = findCnameCoexistenceViolations(records);
  if (violations.length === 0) {
    console.log("No CNAME coexistence violations found.");
    return;
  }

  for (const v of violations) {
    console.warn(
      `${v.name} has a CNAME plus ${v.types.join(", ")} (${v.conflictingIds.length} record(s) to remove or relocate)`,
    );
    for (const recordId of v.conflictingIds) {
      if (DRY_RUN) {
        console.log(`Would delete record ${recordId} at ${v.name}`);
        continue;
      }
      const delRes = await fetch(
        `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records/${recordId}`,
        { method: "DELETE", headers },
      );
      if (!delRes.ok) throw new Error(`Cloudflare delete returned ${delRes.status}`);
      console.log(`Deleted record ${recordId} at ${v.name}`);
    }
  }

  console.log(`Done. ${violations.length} name(s) had a conflict.`);
}

run().catch((err) => { console.error(err); process.exit(1); });

from cname_coexistence import find_cname_coexistence_violations


def rec(name, type_, id_):
    return {"name": name, "type": type_, "id": id_}


def test_flags_cname_with_txt_at_same_name():
    records = [
        rec("app.example.com", "CNAME", "r1"),
        rec("app.example.com", "TXT", "r2"),
    ]
    violations = find_cname_coexistence_violations(records)
    assert len(violations) == 1
    assert violations[0]["name"] == "app.example.com"
    assert violations[0]["conflicting_ids"] == ["r2"]
    assert violations[0]["types"] == ["TXT"]


def test_clean_zone_has_no_violations():
    records = [
        rec("www.example.com", "CNAME", "r1"),
        rec("example.com", "A", "r2"),
        rec("example.com", "MX", "r3"),
    ]
    assert find_cname_coexistence_violations(records) == []


def test_name_matching_is_case_insensitive():
    records = [
        rec("App.Example.com", "CNAME", "r1"),
        rec("app.example.com", "A", "r2"),
    ]
    violations = find_cname_coexistence_violations(records)
    assert len(violations) == 1
    assert violations[0]["conflicting_ids"] == ["r2"]


def test_lone_cname_is_not_a_violation():
    records = [rec("sub.example.com", "CNAME", "r1")]
    assert find_cname_coexistence_violations(records) == []

import { test } from "node:test";
import assert from "node:assert/strict";
import { findCnameCoexistenceViolations } from "./cname-coexistence.js";

const rec = (name, type, id) => ({ name, type, id });

test("flags CNAME with TXT at same name", () => {
  const records = [rec("app.example.com", "CNAME", "r1"), rec("app.example.com", "TXT", "r2")];
  const violations = findCnameCoexistenceViolations(records);
  assert.equal(violations.length, 1);
  assert.equal(violations[0].name, "app.example.com");
  assert.deepEqual(violations[0].conflictingIds, ["r2"]);
  assert.deepEqual(violations[0].types, ["TXT"]);
});

test("clean zone has no violations", () => {
  const records = [
    rec("www.example.com", "CNAME", "r1"),
    rec("example.com", "A", "r2"),
    rec("example.com", "MX", "r3"),
  ];
  assert.deepEqual(findCnameCoexistenceViolations(records), []);
});

test("name matching is case insensitive", () => {
  const records = [rec("App.Example.com", "CNAME", "r1"), rec("app.example.com", "A", "r2")];
  const violations = findCnameCoexistenceViolations(records);
  assert.equal(violations.length, 1);
  assert.deepEqual(violations[0].conflictingIds, ["r2"]);
});

test("lone CNAME is not a violation", () => {
  const records = [rec("sub.example.com", "CNAME", "r1")];
  assert.deepEqual(findCnameCoexistenceViolations(records), []);
});