When you add a domain to Cloudflare, you manage DNS records that tell browsers and other services where to find your website, email and other online services.<\/p>\n
Some DNS records can use Cloudflare’s proxy, while others operate in DNS-only mode. Understanding this distinction matters because it affects how traffic reaches your server and which Cloudflare features can apply to that traffic.<\/p>\n
A DNS-only record tells Cloudflare to provide the DNS answer without proxying the connection through its network. The visitor’s connection goes directly to the destination server rather than passing through Cloudflare’s HTTP proxy.<\/p>\n
This arrangement can be appropriate for services that need direct connections or are not supported by Cloudflare’s standard web proxy. However, it also means that the traffic associated with that record does not receive the same proxy-based protection and performance features.<\/p>\n
A proxied record routes supported traffic through Cloudflare before it reaches the origin server. In the Cloudflare dashboard, this is commonly represented by an orange cloud icon.<\/p>\n
When a website’s relevant DNS records are proxied, Cloudflare can apply supported security and performance features to eligible requests. These include configured web application firewall rules, DDoS mitigation and caching of eligible content.<\/p>\n
For example, when a visitor requests a proxied website, Cloudflare receives the request and processes it according to the applicable configuration before forwarding it to the origin when necessary.<\/p>\n
This arrangement can help reduce direct exposure of the origin IP address through the proxied DNS response. However, it does not guarantee that the origin address cannot be discovered through other records, historical information or other infrastructure.<\/p>\n
Proxied mode is an important part of many Cloudflare website security configurations, but it is not a complete security solution on its own.<\/p>\n
The orange cloud indicates that a supported record is proxied through Cloudflare. The grey cloud indicates that the record is DNS-only.<\/p>\n
The distinction is especially important for website owners who expect Cloudflare to filter incoming web requests.<\/p>\n
If a website’s relevant records are DNS-only, its web traffic does not pass through Cloudflare’s standard HTTP proxy using those records. As a result, the website will not receive the same proxy-based web security and caching benefits for that traffic.<\/p>\n
If the records are proxied, eligible traffic can pass through Cloudflare’s security and performance systems. The exact protection still depends on the plan, enabled features and configured rules.<\/p>\n
Neither setting is universally correct for every DNS record. The appropriate choice depends on the service being connected and the requirements of that service.<\/p>\n
For many websites, the main domain and the For example, a business website might have an address record for its main domain and a CNAME record for Other records require more careful consideration. Mail server records, including MX records, should not be treated like ordinary proxied website records. Services such as SSH, FTP and other non-HTTP applications may also require DNS-only records or a different Cloudflare product designed for those connections.<\/p>\n Changing a record without understanding its purpose can interrupt email delivery or other services. Before adjusting DNS, identify what each record supports and confirm that the intended service is compatible with the proxy.<\/p>\n No. Enabling the proxy is an important configuration step, but it does not automatically make a website invulnerable.<\/p>\n The protection available depends on the Cloudflare plan, the features enabled, the security rules configured and whether the origin server is properly secured.<\/p>\n For example, a proxied website may still contain outdated WordPress plugins, weak administrator credentials or vulnerable application code. Cloudflare can help filter supported requests, but it does not automatically repair those weaknesses.<\/p>\n Website owners should also review their SSL\/TLS configuration. When Cloudflare connects to an origin server over HTTPS, an appropriate configuration such as Full (strict) should be used when the origin supports a valid certificate.<\/p>\n The origin server’s firewall and access controls also matter. If direct connections to the origin remain available, some requests may bypass the Cloudflare controls that the website owner expects to enforce.<\/p>\n A business website often depends on several services working together. Its public pages, customer portal, email, forms and integrations may rely on different DNS records and connection types.<\/p>\n A careless DNS change can make a website unavailable, interrupt email or interfere with an application. Conversely, leaving an important website record in DNS-only mode may prevent the intended Cloudflare proxy-based protections from applying.<\/p>\n Businesses should therefore maintain an inventory of their DNS records, understand which services each record supports and test changes before considering the configuration complete.<\/p>\n If a website experiences errors after a change, review the DNS destination, proxy status, SSL\/TLS settings and origin-server health before assuming that Cloudflare itself is responsible.<\/p>\n For businesses that want help setting up and maintaining Cloudflare-based website protection, Tremhost offers Armor Guard from $9 per month per website<\/strong>.<\/p>\n Armor Guard provides Cloudflare Pro-based protection with technical configuration and support from Tremhost. It gives eligible businesses an alternative to purchasing the commonly advertised $25-per-month Cloudflare Pro subscription directly.<\/p>\n The appropriate configuration depends on the website, hosting environment and services connected to the domain. Businesses should confirm which setup and support tasks are included before proceeding.<\/p>\n Explore Tremhost’s Cloudflare solutions<\/a> or visit Armor Guard<\/a> to learn more.<\/p>\n The difference between DNS-only and proxied records is fundamental to understanding how Cloudflare handles website traffic.<\/p>\n DNS-only records provide DNS resolution without routing supported web traffic through Cloudflare’s standard proxy. Proxied records allow eligible traffic to pass through Cloudflare, where applicable security and performance features can be applied.<\/p>\n The right configuration depends on the service behind each record. Website owners should avoid blindly proxying every record and instead verify the purpose of each service, its compatibility and the protection required.<\/p>\nwww<\/code> record can use Cloudflare’s proxy, provided the destination and application are compatible.<\/p>\nwww<\/code>. If these records serve the public website over supported HTTP or HTTPS connections, proxying them can allow Cloudflare’s applicable web security and performance features to operate.<\/p>\nDoes Enabling the Orange Cloud Automatically Secure Your Website?<\/h2>\n
Why Cloudflare DNS Configuration Matters for Businesses<\/h2>\n
Get Help Configuring Cloudflare Through Tremhost<\/h2>\n
Final Thoughts: Check Your Cloudflare Proxy Settings<\/h2>\n