Cloudflare DNS records explained

Record anatomy

Every record in Cloudflare DNS is a row that says: for this name, of this type, point at this content, with this TTL. A proxied record also carries a second state: whether traffic passes through the edge or goes straight to the origin.

| Field | Example | Meaning |

| Name | www | Host label under the zone |

| Type | A / AAAA / CNAME / MX / TXT | What kind of answer |

| Content | 203.0.113.25 | Where to point |

| Proxy status | orange cloud | Proxied through Cloudflare |

| TTL | Auto / 300 | How long resolvers may cache |

A record with a trailing dot in the Name means the answer is the zone root: @ in many panels equals example.com itself.

Proxy status: orange or grey

On the record list, an orange cloud means the record is proxied, and a grey cloud means DNS only.

| State | Traffic path | What works |

| Proxied (orange) | Visitor to edge to origin | CDN cache, WAF rules, SSL of the visitor leg, DDoS protection |

| DNS only (grey) | Visitor to origin IP directly | No cache, no edge protection, TLS only if your host does it |

While grey, Cloudflare simply answers DNS for that name and takes no part in the connection. This is the correct escape hatch during troubleshooting, because it proves whether the origin itself responds to normal traffic.

Common record types

• A: maps a hostname to an IPv4 address. For example, www to 203.0.113.25.
• AAAA: the same for IPv6. Use it when your host publishes a v6 address.
• CNAME: aliases one name to another DNS name. With Cloudflare external CNAME, proxied CNAME records point to a target that may live outside your zone.
• MX: mail exchange for the domain. Proxy status is irrelevant, mail servers are grey cloud by definition.
• TXT: arbitrary text, most often for SPF, DKIM, and domain verification records.
• SRV, NS, and CAA appear too, and DNS record types reference describes each in detail.

Add or change a record

1. Open DNS > Records for the zone, then Add record.
2. Pick the type, set the Name, and paste the Content. For an A record, the content is the IP. For a CNAME, it is a target hostname.
3. Decide proxy status. For a site you want Cloudflare to protect and cache, leave orange. For an origin-only route such as direct.origin.example.com, use grey.
4. Enable proxy mode only after you confirm the origin responds correctly and the SSL mode matches. A brand new A record flipped orange while the origin rejects the edge connection shows 521 or 522.
5. Save and test. Remember DNS propagation: Cloudflare is authoritative, so its own records change instantly, but third-party resolvers hold the old answer until the TTL elapses. Use the check DNS propagation tools guide to see the state.

TTL notes

Cloudflare recommends Auto for normal records, and a short manual TTL during migration so cutovers land within minutes rather than hours. For any record that is part of a migration, keep TTL low until the migration is complete.

Zone ownership

You cannot add records to a zone until the domain's nameservers point at Cloudflare (see the nameservers guide). Until then the dashboard offers a partial record set that is only active after delegation completes.