The Cloudflare DNS manager is a powerful tool with an intuitive interface. DNS changes apply instantly across the Cloudflare network, which is much faster than traditional registrars.
DNS Record Modes
Proxied (orange cloud ☁️)
- Traffic passes through the Cloudflare CDN
- The real IP is hidden
- Available: CDN, DDoS protection, WAF, optimization
- Suitable for: A, AAAA, CNAME records pointing to web servers
DNS Only (grey cloud ⛅)
- Cloudflare only resolves DNS, traffic goes directly
- The real IP is visible
- No CDN or protection
- Required for: MX, SPF, DKIM, FTP, SSH records
Adding DNS Records
| Type | Usage Example | Proxy? |
|---|---|---|
| A | @ → 192.168.1.1 (main site) | ✅ Yes |
| CNAME | www → example.com | ✅ Yes |
| MX | @ → mail.example.com (mail) | ❌ No |
| TXT | @ → v=spf1... (SPF) | ❌ No |
| TXT | mail._domainkey → (DKIM) | ❌ No |
| CNAME | ftp → FTP server | ❌ No |
TTL in Cloudflare
For Proxied records, TTL is automatically set to Auto (300 seconds). For DNS Only, you can choose between 1 minute and 24 hours.
Checking DNS Records
# Check the A record through Cloudflare DNS
dig @1.1.1.1 example.com A
# Check MX
dig @1.1.1.1 example.com MX
# Check that Proxy is working (should return Cloudflare's IP, not yours)
dig example.com AA CNAME at the root domain (CNAME flattening)
The DNS standard forbids a CNAME record at the apex domain (example.com with no subdomain) alongside other records. Cloudflare works around this automatically: if you create a CNAME at @, Cloudflare "flattens" it into A/AAAA records for the target host at its own server level. This is handy for integrating with services like Vercel or Netlify that only give out a CNAME address.
Breaking down DNS errors
Error 1000: DNS points to prohibited IP
Cloudflare blocks creating a proxied record that points to a private (10.0.0.0/8, 192.168.0.0/16) or reserved IP range. The fix is to use the server's real public IP, or switch the record to DNS Only mode if it is only needed for an internal network.
Error 1001: DNS resolution error
This happens when a proxied record points to a host that itself does not resolve (for example, a CNAME to a subdomain that no longer exists). Check the chain of records from the root and make sure the final record is a working A/AAAA address.
The domain does not resolve at all
If the domain does not respond more than 24 hours after switching nameservers, check with the registrar that the nameservers were saved exactly as Cloudflare gave them (no typos, no extra dots), and that the registrar is not blocking a nameserver change for some period after the domain was purchased. The connection process itself is covered in the article on adding a site to Cloudflare.
Verifying the result
# Confirm the domain uses Cloudflare's nameservers
dig example.com NS +short
# Compare the answer straight from Cloudflare with a public resolver
dig @1.1.1.1 example.com A +short
dig @8.8.8.8 example.com A +short
# Both should return the same result once propagation finishesWhen Cloudflare's DNS manager does not fit
- You need DNSSEC with keys managed by a third-party registrar that does not support delegating to Cloudflare — you will have to either transfer the domain or disable DNSSEC for a while.
- You need exotic record types that Cloudflare does not support on the free plan (for example, some extended formats used by internal DNS servers).
- Mail records (MX, SPF, DKIM) need separate message routing — see the article on Email Routing in Cloudflare if you want to receive mail without running a separate mail server.
Cloudflare supports Secondary DNS: you can keep the primary DNS server on your own infrastructure and set up a one-way zone transfer over AXFR to Cloudflare as a secondary server — changes are made on the origin server, and Cloudflare just distributes a copy worldwide.
An MX record in Cloudflare has a separate Priority field (a lower number means a higher-priority server). If mail is backed up across several MX records, the second server should carry a higher priority value (for example, 10 and 20) — otherwise both are treated as equal and mail can get lost when one of them is unreachable.
Global propagation is easy to check with third-party services like whatsmydns.net — they show the DNS answer from dozens of locations around the world at once, making it obvious where the update has already applied and where it still returns the old value.
Frequently asked questions
Why can Proxied mode break SSH or FTP access to a server?
In Proxied mode traffic routes through the Cloudflare network instead of going straight to the server, and Cloudflare only proxies HTTP and HTTPS. SSH, FTP, and other non-standard ports simply don't pass through Proxied, so such records must switch to DNS Only mode, where the request goes directly to the server's real IP, bypassing Cloudflare entirely.
Do you need to wait for DNS propagation when switching a record between Proxied and DNS Only?
Toggling the cloud icon in Cloudflare applies instantly inside Cloudflare's own network, without the usual wait for worldwide DNS propagation. However, caches on end-user devices and intermediate resolvers may hold onto the old answer until the record's TTL expires, so the effect sometimes isn't felt right away even though the setting itself changes on Cloudflare's side without delay.
What is Secondary DNS in Cloudflare and when is it useful?
Secondary DNS lets you keep the primary DNS server on your own infrastructure while Cloudflare acts only as a secondary node that distributes a copy of the zone worldwide through a one-way AXFR transfer. This setup fits situations where record changes must happen on an internal server for organizational reasons, rather than through the Cloudflare dashboard itself.
Why might mail fail to arrive even though the MX record in Cloudflare looks correct?
A common cause is a wrong priority on backup MX records: if the primary and backup mail servers share the same Priority value, they're treated as equal, and messages can get routed to an unreachable server. Mail records must also run in DNS Only mode — if MX or SPF ends up set to Proxied by mistake, mail delivery breaks.