Proxied or DNS only: Cloudflare's orange and grey clouds
A proxied record (orange cloud) sends visitors through Cloudflare, which hides your server's address and adds caching, security and a certificate. A DNS-only record (grey cloud) gives out the real address. Websites are usually proxied; email never is.
Applies to: Cloudflare
On this page
In Cloudflare, each A, AAAA and CNAME record is either proxied (an orange cloud) or DNS only (a grey cloud). Proxied means visitors connect to Cloudflare, which passes the request on to your server: your server's real address stays hidden, and Cloudflare adds caching, security and the certificate visitors see. DNS only means Cloudflare gives out your server's real address and stays out of the way. Website records are usually proxied. Email-related records are always DNS only.
The two settings
| Proxied (orange cloud) | DNS only (grey cloud) | |
|---|---|---|
| Visitors connect to | Cloudflare, which forwards to your server | Your server directly |
| Address a lookup shows | A Cloudflare address | Your server's real address |
| Caching and security | Added by Cloudflare | None from Cloudflare |
| Certificate visitors see | Cloudflare's edge certificate | The one on your server |
| TTL | Auto (300 seconds) | 60 seconds to 1 day |
| Record types | A, AAAA, CNAME | Any type |
Which records use which
- Your website (the bare domain and
www): usually proxied. Cloudflare's certificate, caching and protection apply, and changes take effect in about 5 minutes. - MX and TXT records: always DNS only. Cloudflare doesn't offer a proxy for them.
- The hostname your MX record points to (for example
mail.example.com): must be DNS only. Mail doesn't pass through Cloudflare's proxy, so a proxied mail hostname breaks email delivery. - Records used by other services (a shop platform, a booking tool, a remote-access hostname): follow that service's instructions. Many ask for DNS only.
How it's set
In Cloudflare's dashboard, each record has a proxy status switch, shown as the cloud icon, next to it. For domains in Oogle's Cloudflare account, we set it when we add the record, based on what the record is for. If you have your own Cloudflare account, you'll find the switch when you add or edit a record on the domain's DNS records page.
If you need a record changed from one to the other, open a Website Support ticket and say which record and why. See How to ask us to change a DNS record.
Check whether a record is proxied
dig a example.com +short
dig a mail.example.com +shortReplace the names with your own. If a website record is proxied, the address that comes back is a Cloudflare address, not our server's. A DNS-only record returns the real address. Without a command line, enter the name at Google Public DNS, select Resolve, and look at the A record.
You'll know it's right when
Your website loads with a padlock and a lookup shows Cloudflare addresses for it, while email sends and arrives normally and the mail hostname (if you have one) shows its real address.
Troubleshooting
- Email stopped after a DNS change. Check that the mail hostname isn't proxied. Tell us right away.
- A service can't connect to your server (for example, FTP or a remote tool). The hostname it uses is probably proxied. Ask us whether it should be DNS only.
- A certificate warning on a DNS-only name. The Cloudflare certificate is only presented for proxied records. The server needs its own certificate for that name.
- Errors 521, 522, 525 or 526. Cloudflare can't connect properly to the server behind a proxied record. See Fix DNS and SSL errors.
- Your server's real address still shows somewhere. Another record (often a DNS-only one) may point to the same server. That's sometimes unavoidable, for example for mail.
Next steps
- Cloudflare SSL/TLS modes explained
- DNS records explained
Frequently asked questions
Why does my domain show a Cloudflare IP address instead of my server's?
Because the record is proxied. Visitors connect to Cloudflare, which forwards the request to our server. That's expected and hides the server's real address.
Can an MX record be proxied?
No. MX and TXT records are always DNS only, and the hostname an MX record points to must be DNS only as well, because mail doesn't pass through the proxy.
A service asked me to turn off the orange cloud. Is that okay?
Sometimes it's needed, for example for a service that has to reach a server directly. Ask us in a ticket and we'll check what it affects before changing it.