Cloudflare Proxied vs DNS-Only: When to Use the Orange Cloud
Practice4 minInnovialabs editorial team
In short
Proxy (orange cloud) your website's HTTP traffic to hide the server IP and get caching, WAF and DDoS protection; keep mail, SSH, databases and other non-HTTP services DNS-only, and set the SSL mode to Full (strict).
The short answer
Every A, AAAA and CNAME record in Cloudflare has a toggle:
- Proxied (orange cloud) — DNS returns Cloudflare's IP addresses, not your server's. All traffic flows through Cloudflare's network and only then reaches the origin.
- DNS only (grey cloud) — Cloudflare acts as a plain DNS server and returns the real IP. Traffic goes straight to your server.
The rule of thumb: website HTTP/HTTPS traffic goes through the proxy, everything else stays DNS-only.
What proxying gives you
- A hidden origin IP. Attackers have a harder time hitting the server directly.
- Caching. Static assets (images, CSS, JS) are served from the Cloudflare location nearest the visitor. HTML is not cached by default — that takes separate rules.
- WAF and DDoS protection. Malicious requests are filtered before they reach your server.
- SSL termination. Cloudflare issues and serves the certificate for visitors; the connection to the origin is configured separately.
- Rules, redirects, compression and other features that only work on proxied traffic.
The limitation: the proxy understands only HTTP and HTTPS, and only on a specific list of ports. Other protocols will not pass through it.
Which records must stay DNS-only
| Record | Why no proxy |
|---|---|
MX and the mail server host (mail.example.com) | Mail uses SMTP/IMAP, which the proxy will not carry |
| SSH, FTP, SFTP | Not HTTP protocols |
| Databases, game servers, VPNs | Non-standard ports and protocols |
| APIs on non-standard ports | The port may not be on the supported list |
| Verification records for third-party services | The service often checks that the CNAME points directly to it |
MX and TXT records cannot be proxied at all — the toggle exists only for A, AAAA and CNAME. But if your MX points to mail.example.com and that A record is proxied, mail breaks.
Keep in mind: a DNS-only record pointing at the same server as your site exposes its IP. If hiding the origin matters, move mail and other services to separate addresses or use Cloudflare Tunnel for SSH.
Problem 1: logs show only Cloudflare IPs
Once proxying is on, your server sees Cloudflare's addresses instead of visitors'. Logs, analytics, per-IP rate limits and bans all break. The real address arrives in the CF-Connecting-IP header (and in X-Forwarded-For). For nginx:
# repeat for every range in Cloudflare's official list
set_real_ip_from 173.245.48.0/20;
real_ip_header CF-Connecting-IP;
Trust the header only from Cloudflare's addresses — otherwise anyone can spoof an IP. Cloudflare publishes the list of ranges on its website and updates it occasionally. In Apache, mod_remoteip does the same job; in applications, use your framework's trusted proxies setting.
Problem 2: an infinite redirect loop
ERR_TOO_MANY_REDIRECTS almost always happens like this: Cloudflare is set to Flexible, and the server redirects HTTP to HTTPS. Cloudflare connects to the origin over HTTP, the server replies "go to HTTPS", the browser comes back to Cloudflare — and round it goes.
The fix is not to remove the server redirect but to install a certificate on the origin and switch the mode to Full (strict).
Choosing the SSL mode
| Mode | Visitor → Cloudflare | Cloudflare → server |
|---|---|---|
| Off | HTTP | HTTP |
| Flexible | HTTPS | HTTP, unencrypted |
| Full | HTTPS | HTTPS, certificate not validated |
| Full (strict) | HTTPS | HTTPS, certificate validated |
Full (strict) is the right choice nearly every time. On the server you can use a free Cloudflare Origin CA certificate (trusted only by Cloudflare, so the site must stay proxied) or a Let's Encrypt certificate. Flexible gives a false sense of security: the browser shows a padlock, yet the leg to your server is unencrypted.
Checklist before turning the cloud orange
- The origin serves HTTPS with a valid certificate.
- SSL mode is Full (strict).
- Mail and service hosts are DNS-only.
- The server restores the real IP from
CF-Connecting-IP. - Optionally, the server firewall accepts web traffic only from Cloudflare ranges.