Setup

import { APIRequest, Tabs, TabItem, DashButton } from "~/components";

In order to enable automatic mitigation of random prefix attacks:

1. Set up DNS Firewall.

2. Enable attack mitigation on your DNS Firewall cluster.

   1. In the Cloudflare dashboard, go to the DNS Firewall Clusters page.

   2. Select the cluster you want to update, then select Edit.

   3. Turn on Attack mitigation and choose whether Cloudflare should only mitigate attacks when the upstream is unhealthy.

   4. Select Save.

   Send a PATCH request to update your DNS Firewall cluster:

   <APIRequest path="/accounts/{account_id}/dns_firewall/{dns_firewall_id}" method="PATCH" json={{ "attack_mitigation": { "enabled": true, "only_when_upstream_unhealthy": true, } }} />

Once you turn on attack mitigation, Cloudflare returns a REFUSED response to queries that are part of a random prefix attack.

:::note

If you do not specify otherwise, Cloudflare automatically sets the only_when_upstream_unhealthy parameter to true, which means that Cloudflare will only mitigate attacks when we detect that the upstream is unresponsive (possibly as a result of an attack).

:::