Protect origins before publishing tunnel DNS
Create and verify every Cloudflare Access application and policy before publishing Tunnel DNS. DNS should be the final mutation, after destination conflicts and public-bypass overrides are rejected. Otherwise, an Access API failure can leave a newly reachable origin exposed even …