Reflib DNS
凌晨两点服务挂了、手边只有手机的时候，你需要的就是这个。完整的 Cloudflare DNS 管理，加上一整套排障工具，全都塞进 iPhone 里。 For the 2 a.m. outage when all you have is your phone. Full Cloudflare DNS management plus a complete troubleshooting kit, packed into an iPhone app.
一个能应急的管理端A console you can actually fix things from
多账户管理Multiple accounts
同时接入多个 Cloudflare 账户，支持 API Token 与 Global API Key 两种凭据，添加时可先「测试连接」确认权限无误。Connect several Cloudflare accounts at once using either an API token or a Global API Key, with a “test connection” step to confirm permissions before you save.
解析记录增删改Full record editing
按类型浏览与分页加载 DNS 记录，直接修改内容、TTL、优先级，一键切换橙云代理状态。Browse and page through DNS records by type, edit content, TTL and priority inline, and flip the orange-cloud proxy with one tap.
Zone 级操作Zone-level actions
开发模式、清除缓存、暂停 Cloudflare、DNSSEC 开关与 Zone 设置，还能直接添加或删除 Zone。Development mode, cache purge, pausing Cloudflare, DNSSEC toggles and zone settings — plus adding or removing zones outright.
DoH 查询与传播检测DoH lookups and propagation checks
通过 Cloudflare、Google、AdGuard 或 AliDNS 发起加密 DNS 查询，并对比多个解析器的结果，判断改动是否已经生效。Run encrypted DNS lookups through Cloudflare, Google, AdGuard or AliDNS, then compare answers across resolvers to see whether a change has landed.
WHOIS / RDAP 与证书检查WHOIS/RDAP and certificate checks
查询域名注册信息，并直接连接目标主机检查 SSL 证书的签发者、有效期与链路情况。Look up registration data, and connect directly to a host to inspect its SSL certificate issuer, validity window and chain.
状态监控与到期提醒Status monitoring and expiry alerts
跟踪 Cloudflare 官方服务状态，并对域名与证书的到期日发出本地通知，不至于某天早上突然发现站点白屏。Track Cloudflare’s official service status and get local notifications before domains and certificates expire, so no morning starts with a blank site.
PDF 报告PDF reports
把某个账户下的全部 DNS 配置导出成 PDF，可打印或分享，交接与存档时很省事。Export an account’s entire DNS configuration as a PDF to print or share — handy for handovers and archiving.
配置备份Configuration backup
通过 .reflibdns 文件导出与导入应用配置，换设备时不必重新配一遍。Export and import app configuration as a .reflibdns file so a device change doesn’t mean setting everything up again.
这款应用怎么处理数据How this app handles data
凭据在钥匙串里，请求不经过我们Credentials in the Keychain, requests never relayed
你填入的 Cloudflare API Token 或 Global API Key 保存在 iOS 钥匙串中，由系统提供保护。所有管理请求都由你的 iPhone 直接发往 api.cloudflare.com，Reflib 没有中转服务器，也无从知道你管理着哪些域名。The Cloudflare API token or Global API Key you enter is held in the iOS Keychain under system protection. Every management request goes straight from your iPhone to api.cloudflare.com; Reflib runs no relay and has no way to know which domains you manage.
除 Cloudflare 之外，应用还会在你使用对应功能时连接：你选择的 DoH 解析器（Cloudflare、Google、AdGuard 或 AliDNS）、用于 RDAP 查询的 rdap.org，以及你指定要检查证书的目标主机 443 端口。这些都是你按下按钮才发生的请求。
Beyond Cloudflare, the app connects — only when you use the matching feature — to your chosen DoH resolver (Cloudflare, Google, AdGuard or AliDNS), to rdap.org for RDAP queries, and to port 443 on whichever host you ask it to inspect. Each is a request you triggered by tapping something.
域名列表、Zone 与记录会缓存在设备本地，方便离线查看。应用不含任何分析或崩溃上报 SDK。 Domain lists, zones and records are cached on device so you can review them offline. The app contains no analytics or crash-reporting SDK of any kind.
建议使用权限受限的 API Token 而非 Global API Key：前者可以精确到「只允许编辑某几个 Zone 的 DNS」，万一设备丢失，影响范围也小得多。你可以随时在 Cloudflare 控制台吊销它。 We recommend a scoped API token over the Global API Key: a token can be limited to “edit DNS for these zones only”, which contains the blast radius if a device is lost. You can revoke it from the Cloudflare dashboard at any time.
常见问题Common questions
会支持阿里云、腾讯云或 DNSPod 吗？Will Aliyun, Tencent Cloud or DNSPod be supported?
目前只支持 Cloudflare。我们更倾向于把一个服务商做透，而不是每家都做个半成品。其他服务商在规划中，但没有承诺时间表。Only Cloudflare today. We would rather do one provider properly than ship half an integration for each. Others are on the roadmap, but with no promised timeline.
这个 App 需要什么 Cloudflare 权限？What Cloudflare permissions does it need?
取决于你要用哪些功能。只看记录的话，Zone 读取权限就够；要改记录需要 DNS 编辑权限；清缓存、开发模式等则需要相应的 Zone 设置权限。建议按最小必要原则创建 Token。It depends on which features you use. Read-only zone access is enough to view records; editing needs DNS edit permission; cache purge and development mode need the matching zone settings permissions. Create the token on a least-privilege basis.
手机丢了怎么办？What if I lose my phone?
立刻到 Cloudflare 控制台吊销对应的 API Token，这会立即使该凭据失效。同时可以用「查找」远程抹掉设备。钥匙串条目在设备有锁屏密码的前提下受系统保护，但吊销 Token 永远是更彻底的做法。Revoke the API token in the Cloudflare dashboard immediately — that invalidates the credential on the spot. You can also erase the device remotely via Find My. Keychain items are protected by the system as long as the device has a passcode, but revoking the token is always the more decisive move.
备份文件里有敏感信息吗？Does the backup file contain anything sensitive?
导出的 .reflibdns 文件包含账户配置信息，请当作敏感文件对待，不要放在共享云盘或通过即时通讯明文发送。The exported .reflibdns file contains account configuration. Treat it as sensitive: keep it off shared cloud drives and don’t send it in the clear over chat.