Not every DNS record should pass through the Cloudflare reverse proxy.
Proxied records
Cloudflare can proxy A, AAAA, and CNAME records used for HTTP or HTTPS traffic.
When a record is proxied:
- Visitors receive Cloudflare IP addresses.
- Web requests pass through Cloudflare.
- Cloudflare can apply TLS, security, Worker, and cache behavior.
- The public origin IP is not returned through normal DNS resolution.
When a record is DNS-only, Cloudflare answers the DNS query but sends traffic directly to the configured destination.
CoreSpeed’s primary web hostnames must be proxied for the Worker and edge-delivery layers to operate.
Records that normally remain DNS-only
These commonly include:
- MX records
- SPF, DKIM, and DMARC records
- Third-party validation CNAMEs
- Service discovery records
- Mail server hostnames
- Non-HTTP protocols
- Records explicitly required to expose their original target
MX and TXT records cannot be proxied. Some CNAME validation records will also fail if they are proxied or flattened.
CNAME flattening
Cloudflare supports CNAME flattening at the zone apex. This makes it possible to configure an apex hostname using a CNAME while returning IP addresses to DNS resolvers. Apex flattening is enabled by default.
Do not enable flattening indiscriminately for verification CNAMEs. Some third-party services expect the original CNAME value to be returned.
DNSSEC
DNSSEC signs the DNS zone and establishes a chain of trust through a DS record held by the domain registry.
The DS record must correspond to the keys used by the current authoritative DNS provider. An old DS record cannot simply remain in place after changing nameservers because it will not match Cloudflare’s signing keys.
After the Cloudflare migration:
- Enable DNSSEC in Cloudflare.
- Copy the generated DS details.
- Add the DS record through the registrar.
- Confirm the Cloudflare status changes to active or confirmed.
- Test resolution using a DNSSEC-aware tool.
Comments
0 comments
Please sign in to leave a comment.