A provider change is not always a public address change
DNS drift means the current DNS configuration differs from the intended configuration. Here, the reference is the Cloudflare configuration you explicitly accepted for a monitored resource. A different cached resolver answer alone does not prove that provider settings drifted.
Cloudflare's proxied records can return Cloudflare addresses rather than the configured origin address. Comparing public A records directly with an origin IP can therefore create a false expectation. Conversely, a provider setting can change while the public answer still looks familiar.
DNStracr's Cloudflare comparison separates the accepted configuration, current provider settings and observed DNS answers. Use this evidence to review drift rather than assuming one view is the complete truth.
Example: proxy mode changed during maintenance
In this fictional example the origin remains 192.0.2.10, but the proxy setting changes. The configuration difference matters even if nobody intended to move the server.
www.example.com · A
Accepted: origin 192.0.2.10 · proxied
Current: origin 192.0.2.10 · DNS only
Review: proxy setting changed; inspect public DNS separately- Connect the appropriate Cloudflare zone in your organization.
- Compare the accepted configuration with the latest fetched settings.
- Review the public DNS evidence using expectations appropriate to proxy mode.
- Investigate the change at Cloudflare before deliberately accepting a new baseline.
Use a baseline deliberately
An accepted configuration is a reference for comparison, not proof of security. Review intentional migrations and accidental edits differently. Accepting an unintended change makes the reference less useful; understand the difference before replacing it.
Keep an operational record of why proxy status, record content or other compared settings changed. DNStracr's evidence can support that review, but provider audit logs remain relevant when you need to establish who performed an action.
Limits of the comparison
Provider access and successful synchronization are required for configuration evidence. Missing or stale provider data should be investigated, not interpreted as confirmation that everything matches. DNStracr does not make corrective DNS changes for you.
The free scan has no access to your Cloudflare account or origin configuration. It checks public DNS only and cannot determine account-level drift, HTTP availability or the security of an origin server.
Technical reference: Cloudflare proxy status. Reviewed 20 October 2026.
Put this into practice
- Connect and sync Cloudflare — Connect a zone, enable comparison and deliberately accept an expected configuration.
YOUR NEXT STEP
Compare your Cloudflare configuration.
Create an account, connect the relevant Cloudflare zone and enable comparison on a monitor. Provider access and a successful sync are required; review the configuration before accepting it as your baseline.
Create your free accountFree plan: 3 domains, 15 active monitors and 1 member per organization. Minimum check interval: 60 minutes. Paid plans and checkout are not available.
Scan your domain free ↗The free scan reads public DNS only. It cannot inspect your Cloudflare account, origin settings or configuration drift.