Cloudflare proxy mode (orange cloud) explained

Orange cloud versus grey cloud

In the Cloudflare DNS list, the cloud icon beside each record sets the proxy status. "Proxied" (orange cloud) means the record's traffic flows through the Cloudflare edge on the visitor-to-origin path. "DNS only" (grey cloud) means Cloudflare only answers DNS lookups and takes no part in the connection.

| Behaviour | Proxied (orange) | DNS only (grey) |

| Caching | Edge caches static assets | No caching by Cloudflare |

| SSL | Edge terminates inbound TLS | TLS is whatever the origin offers |

| WAF / DDoS | Edge filters protect | None from the edge |

| Origin IP | Hidden from visitors | Fully exposed |

| Response headers | cf-ray and edge headers present | Direct origin headers only |

What proxied traffic means

When a record is orange, each request takes this path:

1. The visitor resolves the name to a Cloudflare IP instead of the origin IP.
2. The edge terminates the connection, applies cache, security rules and the SSL mode.
3. The edge connects to the origin IP stored in the record and asks for the resource in the origin's preferred protocol (HTTP or HTTPS, per the SSL mode).
4. The origin sends back a response, which the edge may cache and then hands to the visitor.

The visitor never talks to the origin IP directly. When you inspect with curl -I you see edge response headers such as cf-ray, which proves the traffic passed through the network.

Why grey cloud is valuable

"DNS only / grey cloud" is the correct switch during diagnostics. It lets you answer "is the origin itself healthy?" because:

• The record still resolves, but to the real IP of the origin.
• Bypassing the edge removes caching and the WAF, so a grey test result tells you the origin works on its own.
• After the grey test, flip back to orange when the origin works, and check the SSL mode to avoid a half-HTTPS setup.

Switch it safely

1. Identify the record (Dashboard > DNS > Records). Find the row for the host, for example www under example.com.
2. Click the cloud icon to toggle it. The orange or grey status saves immediately.

Record:       www    A    203.0.113.25     orange cloud (proxied)

1. Allow the TTL window to pass. Because the edge IPs change the visible address, local DNS caches can hold the old answer for the TTL interval you set. Keep TTL low during the cutover.
2. Retest. On the grey side use curl -H "Host: www.example.com" http://origin-ip/ to check the origin response, and after flipping back orange verify the edge, the certificate, and the absence of 521/522 errors.

When to leave grey

• Mail records (MX and the associated SPF/DKIM TXT records) must stay grey; proxying an MX record tries to run the edge in front of email, which breaks mail flows.
• Endpoints where you control a static IP allowlist, such as SSH or a database port, should stay grey.
• Non-HTTP traffic, such as TCP or UDP services, stays grey because Cloudflare proxy handles HTTP/HTTPS only.

Use the DNS record list for the zone to see each record's proxy status, and confirm every host you want shielded is proxied and every host that must stay direct is grey.