diff --git a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx
index 2fb9c4b5517bf2..838bdddefd610a 100644
--- a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx
+++ b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx
@@ -3,10 +3,9 @@ title: Create an allowlist or blocklist
pcx_content_type: learning-unit
sidebar:
order: 2
-
---
-import { Tabs, TabItem } from "~/components"
+import { Tabs, TabItem } from "~/components";
In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications.
@@ -15,35 +14,42 @@ Gateway supports creating [lists](/cloudflare-one/policies/gateway/lists/) of UR
## Example list policy
+
+
The following DNS policy will allow access to all approved corporate domains included in a list called **Corporate Domains**.
| Selector | Operator | Value | Action |
| -------- | -------- | ------------------- | ------ |
-| Domain | in list | *Corporate Domains* | Allow |
+| Domain | in list | _Corporate Domains_ | Allow |
+
+
- ```sh
-curl --request POST \
- --URL https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
+
+```sh
+curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
--header 'Content-Type: application/JSON' \
- --header "Authorization: Bearer " \
+ --header "Authorization: Bearer " \
--data '{
"name": "All-DNS-CorporateDomain-AllowList",
"description": "Allow access to the corporate domains defined under the Corporate Domains list",
"precedence": 1,
- "enabled": false,
+ "enabled": true,
"action": "allow",
"filters": [
"dns"
],
- "traffic": "any(dns.domains[*] in $)"
+ "traffic": "any(dns.domains[*] in $)"
}'
+```
- ```
+
+
To create a new DNS policy using **Terraform** to allow access to all approved corporate domains included in a list called **Corporate Domains**.
+
```tf
resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access" {
account_id = var.account_id
@@ -56,5 +62,7 @@ resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access"
traffic = "any(dns.domains[*] in $)"
}
```
+
-
\ No newline at end of file
+
+
diff --git a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx
index f28b5b5da63784..5e93f1f9dcdf24 100644
--- a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx
+++ b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx
@@ -5,7 +5,7 @@ sidebar:
order: 1
---
-import { Tabs, TabItem, Render } from "~/components"
+import { Render, Tabs, TabItem } from "~/components";
DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP.
@@ -14,7 +14,9 @@ You can filter DNS traffic based on query or response parameters (such as domain
To create a new DNS policy:
+
+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
2. In the **DNS** tab, select **Add a policy**.
3. Name the policy.
@@ -27,48 +29,57 @@ To create a new DNS policy:
6. Select **Create policy**.
For more information, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/).
+
+
-To create a new DNS policy using **cURL**:
- ```sh
- curl --request POST \
- --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
- --header 'Content-Type: application/JSON' \
- --header "Authorization: Bearer " \
- --data '{
+
+To create a new DNS policy using cURL:
+
+```sh
+curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
+ --header 'Content-Type: application/JSON' \
+ --header "Authorization: Bearer " \
+ --data '{
"name": "All-DNS-SecurityCategories-Blocklist",
- "description": "Block known security risks based on Cloudflare's threat intelligence",
- "precedence": 0,
- "enabled": false,
- "action": "block",
- "filters": [
- "dns"
- ],
- "traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
- "rule_settings": {
- "block_page_enabled": true,
- "block_reason": "This domain was blocked due to being classified as a security risk to the organisation"
- }
- }'
- ```
+ "description": "Block known security risks based on Cloudflare's threat intelligence",
+ "precedence": 0,
+ "enabled": true,
+ "action": "block",
+ "filters": [
+ "dns"
+ ],
+ "traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
+ "rule_settings": {
+ "block_page_enabled": true,
+ "block_reason": "This domain was blocked due to being classified as a security risk to your organization"
+ }
+ }'
+```
+
+
+
To create a new DNS policy using **Terraform**:
+
```tf
resource "cloudflare_zero_trust_gateway_policy" "security_risks_dns_policy" {
account_id = var.account_id
name = "All-DNS-SecurityCategories-Blocklist"
description = "Block known security risks based on Cloudflare's threat intelligence"
precedence = 0
- enabled = false
+ enabled = true
action = "block"
filters = ["dns"]
traffic = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
rule_settings {
block_page_enabled = true
- block_page_reason = "This domain was blocked due to being classified as a security risk to the organisation"
+ block_page_reason = "This domain was blocked due to being classified as a security risk to your organization"
}
}
```
+
+
diff --git a/src/content/partials/cloudflare-one/gateway/lists.mdx b/src/content/partials/cloudflare-one/gateway/lists.mdx
index 0e49c4f5f44da2..f410291bb0639f 100644
--- a/src/content/partials/cloudflare-one/gateway/lists.mdx
+++ b/src/content/partials/cloudflare-one/gateway/lists.mdx
@@ -38,9 +38,8 @@ You can now use this list in the policy builder by choosing the _in list_ operat
```bash
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/lists \
---header "X-Auth-Email: " \
---header "X-Auth-Key: " \
--header "Content-Type: application/json" \
+--header "Authorization: Bearer " \
--data '{
"description": "Private application IPs",
"items": [{"value": "10.226.0.177/32"},{"value": "10.226.1.177/32"}],