Merge PR #168: add Cloudflare DNS integration

Add Cloudflare REST-backed domain discovery, DNS inspection, recommendations, and DNS change tracking. Closes #31.

docs/deployment/configuration.md

@@ -110,11 +110,21 @@ operational policy if long-term storage size matters.
 
 | Variable | Description | Default | Example |
 |----------|-------------|---------|---------|
-| `CF_ENABLED` | Enable Cloudflare integration | `false` | `true`, `false` |
-| `CF_API_TOKEN` | Cloudflare API token | - | `your_cloudflare_api_token` |
-| `CF_ZONE_ID` | Cloudflare Zone ID | - | `your_cloudflare_zone_id` |
+| `CLOUDFLARE_API_TOKEN` | Cloudflare API token for read-only zone discovery and DNS inspection | - | `your_cloudflare_api_token` |
+| `CLOUDFLARE_ZONE_ID` | Optional default Cloudflare Zone ID | - | `your_cloudflare_zone_id` |
 | `WEBHOOK_SECRET` | Required secret for inbound email worker webhooks | - | `openssl rand -hex 32` |
 
+Cloudflare credentials can also be stored from **Settings**. The API token is
+encrypted in the settings table and redacted when settings are read back. Leave
+the Zone ID blank to discover every active zone visible to the token.
+
+The read-only integration exposes:
+
+- `GET /api/v1/domains/cloudflare/discover` to list available zones.
+- `POST /api/v1/domains/cloudflare/import` to create monitored domain rows from zones.
+- `GET /api/v1/domains/{domain}/dns/cloudflare` to inspect managed DNS records, return DMARC/SPF/DKIM suggestions, and record detected DNS changes.
+- `GET /api/v1/domains/{domain}/dns/history` to review DNS record additions, modifications, and removals.
+
 ### DNS Result Cache
 
 DMARC, SPF, and DKIM DNS checks are cached in the database-backed `dns_cache`
@@ -123,6 +133,10 @@ API responses include whether the result came from cache and when it was
 checked. Use `?refresh=true` on the domain DNS endpoint to bypass a fresh cache
 entry for operational rechecks.
 
+Cloudflare-managed DNS record snapshots and change events are stored in
+`dns_record_snapshots` and `dns_record_changes`. They are updated whenever the
+Cloudflare DNS analysis endpoint is called.
+
 ### Advanced Configuration
 
 | Variable | Description | Default | Example |

docs/development/roadmap.md

@@ -84,7 +84,7 @@ Follow-up:
 ## Later Milestones
 
 - Notifications and alert rules. Apprise delivery, test notifications, alert-rule evaluation, scheduled daily/weekly summaries, and alert history are in place.
-- DNS health and Cloudflare read-only inspection.
+- DNS health and Cloudflare read-only inspection are in place, including zone import, record recommendations, and DNS change tracking.
 - Guided setup and operator health screens.
 - Forensic/RUF report support.
 

docs/milestones.md

@@ -125,18 +125,19 @@ Exit criteria:
 
 ## Milestone 8: DNS Health and Guidance
 
-Status: Planned
+Status: Complete
 
 Goal: connect report findings with DNS configuration guidance.
 
 Delivered:
 - DMARC/SPF/DKIM DNS checks with database-backed cached results.
 - DKIM selector discovery from report data.
-
-Planned:
 - Per-domain DNS health summary.
+- Cloudflare read-only integration for automatic domain discovery and DNS record inspection.
+- Import Cloudflare zones as monitored domains from Settings.
+- Suggestions for missing, duplicate, or malformed DMARC/SPF/DKIM records.
+- DNS record snapshots and change history for Cloudflare-managed records, including additions, modifications, and removals.
 - Suggestions for moving from `p=none` to enforcement when compliance supports it.
-- Optional Cloudflare read-only integration for DNS record inspection.
 
 Exit criteria:
 - A user can see whether DNS records match the actual senders observed in DMARC reports.

docs/user_guide/settings.md

@@ -103,11 +103,17 @@ DMARQ provides an API for integration with other systems:
 
 If you use Cloudflare for DNS management:
 
-1. Navigate to **Settings** > **Integrations** > **Cloudflare**
+1. Navigate to **Settings** > **Cloudflare Integration**
 2. Configure:
    - **API Token**: Your Cloudflare API token
-   - **Zone ID**: The Cloudflare Zone ID for your domain
-   - **Permissions**: What actions DMARQ can take on your DNS records
+   - **Zone ID**: Optional Cloudflare Zone ID for a single domain
+3. Use **Discover** to list zones visible to the token.
+4. Use **Import New** to create monitored domain rows for discovered zones that are not already tracked.
+
+The token only needs read access for zone and DNS record inspection. DMARQ uses
+it to fetch managed DNS records, detect missing or malformed DMARC/SPF/DKIM
+entries, and record DNS additions, modifications, or removals over time. DMARQ
+does not automatically change Cloudflare DNS records.
 
 ### Other Integrations