DNS, the orange cloud, and proxy status
Understand proxied and DNS-only A, AAAA, and CNAME records without confusing proxying with caching.
Edited and verified by Orange Book Editorial Team ·
One sentence to remember
The orange cloud decides whether traffic reaches Cloudflare first. It does not prove that a response was cached.
Three separate decisions
| Question | Controlled by | What it proves |
|---|---|---|
| Who answers DNS? | Whether nameservers use Cloudflare | Cloudflare manages DNS for the zone |
| Does traffic cross the edge? | Proxy status on A, AAAA, or CNAME | Proxy-layer features can run |
| Was this response cached? | Method, headers, and Cache Rules | This request used a cached object |
DNS-only records return the configured origin address. Proxied records return Cloudflare addresses and hide the ordinary HTTP origin address. Only A, AAAA, and CNAME records that resolve to an IP can be proxied; do not copy that setting onto mail records.
Minimal verification
Query DNS
dig +short www.example.com AA proxied record normally returns Cloudflare addresses; DNS-only normally returns the configured origin. Verify the answer instead of trusting an icon.
Observe the HTTP path
curl -I https://www.example.com/Record the status, server, cf-ray, and cf-cache-status headers. A missing cache status is not automatically a fault because not every response is cache eligible.
Check origin exposure
Confirm that stale DNS, mail records, or public services do not still reveal the same origin IP. Proxying is not an origin firewall.
Common mistakes
- Proxying a mail target to “make email safer”; normal mail protocols do not use the HTTP proxy.
- Treating the orange cloud as a cache hit; continue with cache-status troubleshooting.
- Changing records repeatedly before accounting for TTL and resolver caches.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.