Zone Holds: Keeping Duplicate Zone Activations Out of Enterprise Accounts
Cloudflare today introduced Zone Holds, a control for enterprise customers that determines whether another account can add the same zone. The feature is designed for large organizations where multiple teams may unknowingly attempt to manage the same domain in separate Cloudflare accounts. When enabled, Zone Holds enforce that only one account can contain a given domain, optionally including subdomains or custom hostnames, unless the account owner of the zone grants explicit permission.
The Problem: Duplicate Zones Lead to Downtime
Cloudflare already requires zones to be authenticated via DNS before traffic is proxied through its global network. That step ensures only domain owners can authorize traffic to be controlled through Cloudflare. But many customers are large organizations with many teams, and one team may not realize a domain is already protected with Cloudflare. If they activate a second instance of the same domain, they replace the original zone another team was managing. That can create downtime or security issues until the original zone is re-activated. In most cases, the problem could be avoided entirely if the teams communicated and chose an alternative like subdomains or custom hostnames. Zone Holds exist to surface that potential risk before a mistake is made.
How Zone Holds Work
With Zone Holds enabled, any attempt to add a domain that is being held returns an error, informing the user they must contact the domain owner first. The holds are enabled by default for all enterprise zones and can be managed from the Zone Overview screen. Optionally, a hold can be extended to cover subdomains and custom hostnames. When disabling a hold, you can set it to re-enable automatically after a specified amount of time, so a hold is not accidentally left disabled.
Example: Before and After
Consider a large customer whose infrastructure team uses Cloudflare to protect all traffic at its primary domain, including a marketing site and a customer-facing API. When that team onboarded, their IT department set DNS records at the registrar so all traffic for the domain routed through Cloudflare.
Later, a marketing department decides to adopt Cloudflare's Bot Management solution for traffic on the marketing subdomain. They sign up the root domain and ask IT to set the provided NS records at the registrar. The IT department does not realize Cloudflare is already in use, so they do not catch that this will impact the existing zone managed by the infrastructure team. The new zone is activated, and an incident occurs because traffic to both the marketing site and the API is impacted.
With Zone Holds, that incident would have been avoided. After adding the domain as an enterprise zone, a Zone Hold is automatically enabled to prevent any other Cloudflare account from adding the same domain. The account owner can also enable a hold on any subdomains or custom hostnames under that domain.
When the marketing team later attempts to add the marketing subdomain to Cloudflare, they receive an error informing them to contact the domain owner. They reach out internally, learn that the infrastructure team manages the domain, and realize activating the zone would have caused an incident. Instead, the two teams agree the marketing team should add just the subdomain, so they can control the marketing site. The infrastructure team lifts the subdomain hold, the marketing team adds the subdomain to their own account, and once set up and activated, they can begin to use Bot Management to protect the marketing site with no unexpected impact.
Availability and Management
Zone Holds are available now to all enterprise zones and are enabled by default at the domain level. They are managed from the Zone Overview screen of any enterprise zone. The optional extension to subdomains and custom hostnames, along with the configurable re-enable timer when disabling a hold, provides flexibility for organizations that need to delegate portions of their domain management without risking accidental duplicate activations.
