Understand zones, DNS, and proxy status

When you add a domain to Cloudflare, you create a zone. A zone is the slice of DNS that Cloudflare manages for that domain. In the full setup you point the domain’s nameservers at Cloudflare, and from then on you edit the DNS records in the Cloudflare dashboard.

Every record in the zone has a proxy status. That’s the orange or gray cloud icon next to it.

A DNS-only record (gray cloud) works like ordinary DNS. Someone asks for app.example.com and gets the IP address of your server. Traffic goes straight to your origin.

A proxied record (orange cloud) returns Cloudflare addresses instead. Cloudflare announces the same IPs from many data centers at once, so HTTP and HTTPS traffic reaches Cloudflare first. Cloudflare then forwards it to your origin.

Notice what the proxy changes and what it doesn’t. It changes the path a request takes. It does not move your server, your files, or your database. Your application stays exactly where it was.

See the difference yourself

Use a practice domain, or a subdomain you don’t mind experimenting with. Create an A record pointing at your server, leave it DNS-only, and ask a resolver what it sees:

dig +short app.example.com A
# 198.51.100.23

That’s your origin address, visible to anyone. Now turn the record to proxied and ask again after a minute:

dig +short app.example.com A
# 104.21.36.114
# 172.67.150.201

Two addresses, both owned by Cloudflare. Your origin IP disappeared from the public answer.

Compare the public answers before and after proxying a practice record:

dig +short app.example.com A
curl -I https://app.example.com

Run both commands while the record is DNS-only, then repeat after the proxy change has propagated. Save the returned addresses and response headers. The exercise should prove the path changed; it should not assume every Cloudflare header or IP remains constant forever.

The proxy only carries web traffic

A proxied record handles HTTP and HTTPS. It does not carry SSH, database connections, or anything else on other ports.

This causes a classic surprise. You proxy app.example.com, and the site works fine. Then ssh app.example.com hangs. Cloudflare received the connection and had nothing to do with it.

The fix is to connect to the server IP directly, or to keep a separate DNS-only record for administration. Be careful with that second option, because a DNS-only record exposes the origin address again. We’ll deal with that trade in the lesson about protecting the origin.

Try this on your own zone: list every record and write next to each one whether it is proxied, and whether it should be.