Cloudflare DNS · Setup + Record Reference

DNS isn't a plan tier — it's how you get a domain onto Cloudflare and how each record behaves. Two setup choices, two cloud states, and the records that do the work.

01 · How the domain gets onto Cloudflare

Full setup · standard path

Cloudflare is authoritative for the whole domain

What happensThe customer changes the nameservers at their registrar to the two Cloudflare-assigned NS records. Cloudflare answers every query for the zone.

Use whenThey control the registrar and want all Cloudflare features. This is the default recommendation.

PlanAny plan.

CNAME setup · keep your DNS provider

Only specific subdomains point to Cloudflare

What happensThe customer keeps their existing authoritative DNS provider and CNAMEs specific subdomains to Cloudflare.

Use whenThey must keep their current provider — compliance, multi-CDN, or a partner setup.

PlanBusiness and Enterprise (plus some partner deals).

02 · Per-record: does traffic go through Cloudflare?

Orange cloud · proxied

Traffic passes through Cloudflare's edge

Traffic pathVisitor connects to Cloudflare first; Cloudflare forwards to your origin.

IP returnedA Cloudflare edge IP — your origin IP is hidden from the public.

What you getWAF, caching, DDoS protection, SSL/TLS termination at the edge, bot management, rate limiting, Workers — every edge feature applies.

Use forWeb traffic you want protected and accelerated — your app hostnames over HTTP/HTTPS.

LimitThe proxy is HTTP/HTTPS only. Orange-clouding a non-web record (like mail) breaks it.

Gray cloud · DNS-only

Cloudflare just answers the query

Traffic pathVisitor connects straight to your origin — Cloudflare is out of the traffic path.

IP returnedYour real origin IP — exposed to the public.

What you getName resolution only. No WAF, caching, or DDoS on that record.

Use forMail records, non-HTTP services, and anything that must not be proxied. Works for any protocol, not just HTTP/HTTPS.

LimitNo Cloudflare protection or acceleration.

One-liner for a call: "Orange means Cloudflare stands in front and protects it; gray means Cloudflare just tells you where it is and steps out of the way."

03 · The records that do the work

Record	What it does	Use it when	Cloud	Plan
A	Maps a hostname to an IPv4 address.	Pointing a hostname at an origin server with a known IPv4.	Either	All
AAAA	Maps a hostname to an IPv6 address.	Same as A, but for IPv6 origins.	Either	All
CNAME	Alias — points one hostname at another hostname. Cannot point to an IP.	Pointing at a load balancer, SaaS provider, or CDN hostname. On the root domain, Cloudflare does CNAME flattening automatically.	Either	All
MX	Tells the world which mail server handles email for the domain.	Setting up email. Pair with TXT for SPF/DKIM/DMARC from the mail provider.	Gray only	All
TXT	Free-form text. Used for SPF, DKIM, domain verification, and more.	Email auth, verifying domain ownership for a SaaS, etc.	Gray only	All
NS	Says which nameservers are authoritative for a domain or subdomain.	Delegating a subdomain to another provider.	Gray only	All
SOA	Caching / admin metadata for the zone. Managed by Cloudflare, not editable.	Never manually — Cloudflare maintains it.	N/A	All
CAA	Restricts which certificate authorities can issue SSL certs for the domain.	Locking down cert issuance. See the Universal SSL gotcha below.	Gray only	All
PTR	Reverse lookup — IP back to hostname.	Reverse DNS requirements (often mail deliverability).	Gray only	Ent
DNSSEC	Cryptographic signing of DNS responses so clients can verify authenticity.	The customer wants anti-spoofing. Enable in DNS → Settings, then copy the DS record to the registrar.	Zone	All

💬 "What setup or record should I use?"

Start with: what are you actually trying to do?

Onboard a domain and want all features → Full setup. Change nameservers at the registrar to the two Cloudflare NS records.
If they must keep their current DNS provider (compliance, multi-CDN, partner), use CNAME setup (Business/Enterprise).
Point a hostname at an IP → A (IPv4) and/or AAAA (IPv6). Point at another hostname → CNAME.
Want Cloudflare to protect it? Orange cloud the record. Otherwise gray cloud and traffic goes direct.
Make email work → MX records for the mail provider, plus TXT for SPF/DKIM/DMARC. Keep them gray cloud.
Lock down who can issue SSL certs → CAA records listing the allowed certificate authorities.
DNS security / anti-spoofing → enable DNSSEC, then copy the generated DS record into the registrar to complete the chain of trust.
A faster / more private resolver for devices → 1.1.1.1, Cloudflare's public recursive resolver. Separate product from authoritative DNS — configured at the OS, router, or browser.

⚠ The gotchas that break DNS

Flag these before the customer hits them

Orange cloud on mail records breaks email. The Cloudflare proxy is HTTP/HTTPS only. MX and mail hostnames must be gray cloud (DNS-only).

DNSSEC + registrar mismatch = total SERVFAIL. If a customer moves to or from Cloudflare and forgets to update the DS record at the registrar, every DNS lookup for the domain fails. Always confirm the DS record matches.

CAA can silently block your own certs. If a customer adds CAA records with Universal SSL on, Cloudflare auto-adds CAA records so its CA partners (Let's Encrypt, Google Trust Services) can still issue. This is the only record type Cloudflare ever adds on a customer's behalf.

CNAME cannot point to an IP. If they need a CNAME on the root domain (example.com), rely on Cloudflare's automatic CNAME flattening rather than trying to point it at an address.

⚡ Quick tests

Prove resolution live on a call

Resolve a record via 1.1.1.1: dig A cloudflare.com @1.1.1.1 — check the status: in the header first (NOERROR = good, SERVFAIL = broken chain, NXDOMAIN = no such name).
Is a record proxied? Resolve it — if you get a Cloudflare edge IP, it's orange cloud; if you get the origin IP, it's gray cloud.
Check DNSSEC: dig DNSKEY example.com +dnssec and confirm the DS record at the registrar matches.

⭐ Best practices

Get DNS right the first time

Orange-cloud your web records; only gray-cloud what must bypass the proxy. Gray-clouding everything "to keep it simple" defeats the purpose — no WAF, caching, or DDoS applies. Reserve gray cloud for mail, SSH, and non-HTTP services.
Keep all mail records gray cloud. MX and mail hostnames must be DNS-only. The proxy is HTTP/HTTPS only, so orange-clouding them breaks email.
Lower TTLs before a big change. Drop TTLs a day ahead so cutovers take effect fast. Proxied (orange) records use "Automatic" TTL (~5 min max globally); unproxied (gray) records honor your set TTL, which can be minutes to days.
Change nameservers at the registrar, not your old DNS provider. The TLD only learns about NS changes made at the registrar. Full propagation can take 24–48 hours (usually faster).
Turn on DNSSEC — but finish the chain. After enabling in DNS → Settings, copy the generated DS record into the registrar. A DS mismatch (or forgetting it during a migration) SERVFAILs the entire domain.
Migrating DNSSEC? Disable at the registrar first. Remove the old DS record, confirm Cloudflare is serving DNS correctly, then re-enable and add the new DS. Don't leave a stale DS behind.
Rely on CNAME flattening at the root. The DNS spec forbids a CNAME at the apex; Cloudflare flattens it automatically. Never try to point a CNAME at an IP — use A/AAAA instead.
Watch CAA when you add it. With Universal SSL on, Cloudflare auto-adds CAA entries for its CA partners (Let's Encrypt, Google Trust Services) so certs keep issuing. Don't strip those out.
Roll out risky records in log/DNS-only first. When unsure whether a record should be proxied, start gray, confirm traffic works, then flip to orange to layer on protection.
Use the dashboard as source of truth for origin IPs. A proxied record returns Cloudflare edge IPs in dig. The real origin IP is the value shown in the DNS app, not the resolver answer.