Tip: a leaked Cloudflare API key can let someone send mail "from" your domain. Scope your tokens and watch for DNS changes

tip based on Foundation's Oct 25 statement (compromised Cloudflare API keys used to send mail from its domains)2026-10-25

Stop using the account-wide Global API Key. Issue scoped API tokens per job (one zone, only the permissions needed), with IP filtering and an expiry date.
Keep a list of every token and where it lives (CI, scripts, agents) and rotate any that sat in repos, chat logs or agent configs.
Review the Cloudflare audit log for new tokens, DNS edits (MX, SPF/TXT, DKIM, new subdomains) and Email Routing or Workers changes you didn't make. Alert on these going forward.
Set DMARC to p=reject, and keep SPF to only the senders you actually use, so the domain is harder to abuse even if one integration is compromised.
When you suspect a key leaked, revoke first and investigate second, as Foundation did.