02 · Decide between Proxied and DNS only
Decide when A, AAAA, and CNAME records should use the orange cloud and when mail, validation, or non-HTTP services must remain DNS only.
Edited and verified by Orange Book Editorial Team ·
The decision rule
The orange cloud is not a decorative “faster DNS” switch. It means HTTP/HTTPS traffic for a hostname reaches Cloudflare first. Enable it only for records that actually carry supported web traffic.
One decision tree
flowchart TD
A[What does this record do?] --> B{A / AAAA / CNAME?}
B -->|No| G[DNS only]
B -->|Yes| C{Carries HTTP or HTTPS?}
C -->|No| G
C -->|Yes| D{Mail / validation / another CDN?}
D -->|Yes| G
D -->|No| E{Upstream supports Cloudflare proxying?}
E -->|No or unknown| G
E -->|Yes| F[Proxied]Common records
| Scenario | Example | Default | Why |
|---|---|---|---|
| Website or public web app | @, www, app | Proxied | Puts CDN, WAF, DDoS protection, and analytics on the path |
| HTTP API | api | Usually Proxied | Enables proxy security and performance, subject to upstream IP validation |
| Mail exchange | MX, mail | DNS only | Ordinary mail protocols do not use the HTTP proxy |
| SPF, DKIM, DMARC | TXT or validation CNAME | DNS only | External systems need the original verification value |
| SaaS domain validation | _verify, ACM validation CNAME | DNS only | Proxying or flattening every CNAME can break validation |
| SSH, FTP, RDP, game ports | ssh, ftp | DNS only | The standard proxy is not a general TCP/UDP proxy |
| CNAME to another CDN | CloudFront, Fastly, and similar | Usually DNS only | Two proxies can conflict over TLS, routing, or hostname ownership |
What proxying changes
| Observation | Proxied | DNS only |
|---|---|---|
| DNS answer | Cloudflare Anycast addresses | Configured origin address |
| Web request path | Reaches Cloudflare first | Client connects directly to target |
| CDN/WAF/HTTP analytics | Can apply | Not on this path |
| Origin IP | Hidden from normal web DNS answers | Directly exposed |
| DNS TTL | Cloudflare-managed Auto value | Controlled by the record setting |
Proxying does not prove the origin is hidden
Historical DNS, mail records, unproxied subdomains, and active scans can still reveal the same IP. Proxy status is not an origin firewall. Restrict production ingress while preserving necessary operations access.
Configure and verify
Assign an owner and purpose first
Do not begin with the cloud icon. Record who uses the hostname, which protocol it carries, and whether a third party requires the original DNS answer or origin IP. Leave an unknown record DNS only until its owner is known.
Proxy web records
Under DNS → Records, enable Proxied only for qualifying A, AAAA, and CNAME records. If one of several A/AAAA records sharing a name is proxied, Cloudflare treats the records for that name as proxied together.
Understand apex CNAME behavior
CNAME flattening allows a CNAME at the zone apex and returns the final IP address. It enables root custom domains for Pages, but can interfere with validation workflows that require the original CNAME response.
Verify DNS and HTTP separately
dig A www.example.com +short
dig MX example.com +short
curl -sS -D - -o /dev/null https://www.example.com/A proxied web hostname usually returns Cloudflare addresses. MX should still name the real mail service. A cf-ray proves that the HTTP request reached Cloudflare, but it does not prove a cache hit.
Three misleading results
- No
CF-Cache-Status: the response may simply be outside caching; proxying can still work. - An old address after a change: account for recursive and local DNS caches before editing repeatedly.
- Failed validation CNAME: confirm DNS only and check whether CNAME flattening was enabled for every CNAME.
For a shorter explanation, read DNS, the orange cloud, and proxy status. Continue with end-to-end TLS.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.
01 · Safely onboard an existing domain to Cloudflare
Review DNS, change authoritative nameservers, handle DNSSEC, and verify that the domain safely reaches Cloudflare.
03 · Establish end-to-end SSL/TLS
Separate visitor-to-Cloudflare and Cloudflare-to-origin connections, configure Origin CA and Full strict, and diagnose 525, 526, or redirect loops.