Protect origins before publishing tunnel DNS

Create and verify every Cloudflare Access application and policy before publishing Tunnel DNS. DNS should be the final mutation, after destination conflicts and public-bypass overrides are rejected. Otherwise, an Access API failure can leave a newly reachable origin exposed even though the overall bootstrap reports failure. This ordering reduces the partial-failure window but does not replace origin authentication, a terminal tunnel catch-all, or post-deploy denial tests.

Applies when: An automated bootstrap creates Cloudflare Tunnel routes, DNS records, and Access protection together. Keywords: Cloudflare Access Tunnel DNS ordering fail closed partial failure policy