---
title: Tip: a leaked Cloudflare API key can let someone send mail "from" your domain. Scope your tokens and watch for DNS changes | ctxsec
url: https://ctxsec.com/items/tip-cloudflare-api-tokens-scope-and-audit-dns-email
description: ""
status: "tip based on Foundation's Oct 25 statement (compromised Cloudflare API keys used to send mail from its domains)"
published: 2026-10-25
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-cloudflare-api-tokens-scope-and-audit-dns-email.md)

tip based on Foundation's Oct 25 statement (compromised Cloudflare API keys used to send mail from its domains)

2026-10-25

### Tip: a leaked Cloudflare API key can let someone send mail "from" your domain. Scope your tokens and watch for DNS changes

- Stop using the account-wide Global API Key. Issue scoped API tokens per job (one zone, only the permissions needed), with IP filtering and an expiry date.
- Keep a list of every token and where it lives (CI, scripts, agents) and rotate any that sat in repos, chat logs or agent configs.
- Review the Cloudflare audit log for new tokens, DNS edits (MX, SPF/TXT, DKIM, new subdomains) and Email Routing or Workers changes you didn't make. Alert on these going forward.
- Set DMARC to p=reject, and keep SPF to only the senders you actually use, so the domain is harder to abuse even if one integration is compromised.
- When you suspect a key leaked, revoke first and investigate second, as Foundation did.

Sources: [Foundation (@FoundationHQ) announcement on X (Oct 25, 11:47 PM ET)](https://x.com/FoundationHQ/status/2114564656199069844) · [Cloudflare docs: Create API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)