Custom domain at Cloudflare

A guide for those whose domain records (DNS) are managed at Cloudflare. The general order of connecting is in Custom domain; here is only what differs in the Cloudflare panel. Always take the records and their values from the connection wizard: it shows exactly what your address needs, with copy buttons.

Where to edit records at Cloudflare#

How to tell your domain’s DNS is at Cloudflare: on the first step the wizard names the provider by the domain’s DNS servers (NS). At Cloudflare they look like gabe.ns.cloudflare.com, sima.ns.cloudflare.com. If the wizard named another provider, add the records there — even if you bought the domain at Cloudflare.

Open the panel: https://dash.cloudflare.com/
Go to: Account → your domain → DNS → Records.
A new record is created with the “Add record” button.
Changes are saved with the “Save” button.

What the wizard shows	Field in the panel
Record type	“Type”
Record name	“Name”
Value (where it points)	“Target”
Time to live	“TTL”
Proxy	“Proxy status”

In the “Name” field type only the left part of the name — without your domain: for www.example.com it is www, for _cenaly-verify.www.example.com — _cenaly-verify.www. The panel appends the domain itself.

The root of the domain (example.com itself) is written as @.

Copy the value with the button in the wizard, exactly as shown. If after saving the panel appended your domain to it (….example.com), add a dot at the end of the value.

Ownership record#

The ownership record proves that the address is being connected by its owner — without it the domain is not reserved for your account. Often there is no separate record: for a subdomain the CNAME record itself (its value starts with the request code) or the certificate record can be the proof — the wizard shows which way applies to you. When it shows a separate ownership record, it is a TXT:

_cenaly-verify.www   TXT   cenaly-verify=<code from the wizard>

Create a record of type TXT.
Name — as in the wizard (_cenaly-verify + your subdomain); the naming rule is above.
Paste the whole value, including cenaly-verify=, without quotes.

Once the domain works, the ownership TXT can be deleted: it is only checked before activation. More — Custom domain → ownership record.

Delete old A, AAAA records and forwarding (if any) on this same name — a CNAME cannot live with other records on the same name. Do not touch records of other names (root, mail, MX).
Create a record of type CNAME.
Name: the left part of the address, for example www (the rule is in the section above).
Value (“Target”): the address from the wizard, via the “Copy” button.
“Proxy status” — switch to DNS only (grey cloud), see the section below.
TTL can stay at the default (300 s).
Save (“Save”).

Right after saving go back to the wizard — it checks the record at the provider’s DNS servers itself and tells you if the name got an extra domain or the value points elsewhere.

Root domain without www#

The root of the domain (example.com without a subdomain) can be connected at Cloudflare: create a CNAME named @ pointing to the address from the wizard — Cloudflare turns it into a proper answer itself (CNAME flattening). For the root the wizard shows one or two more records (ownership and certificate) — add them too.

Forwarding the root to www is available at Cloudflare and works for https://.

Proxy: DNS only#

Every Cloudflare record has a “Proxy status” toggle. For our domain records it must be DNS only — a grey cloud. New records are created with the proxy on (orange cloud), so switch it off explicitly. Ownership checks and certificate issuance do not pass through the Cloudflare proxy: the wizard then shows “the Cloudflare proxy seems to be on”. The site will not get slower — we have our own delivery network.

The same applies to the ownership and certificate records. The “Flatten all CNAMEs” zone setting also breaks the check — do not enable it.

Certificate record#

The secure connection (HTTPS) turns on by itself: the certificate is issued and renewed for free. For this the wizard sometimes asks for one more record — the certificate authority needs it:

_acme-challenge.www of type CNAME — to an address like ….cm.yandexcloud.net (Russian side);
_cf-challenge of type TXT — for the root of the domain (international side).

They are created like the other records: name by the rule above, value via the button in the wizard. If the name _acme-challenge already has records of a previous service (another hosting with a Let’s Encrypt certificate), delete them — otherwise the certificate is not issued. Do not delete these records after connecting: the certificate is renewed through them.

How long to wait#

Cloudflare’s documentation does not say how fast it publishes changes — usually minutes. The wizard checks the record right at the provider’s DNS servers, so it tells “the record is still spreading” from “the record is wrong” and in the first case shows an approximate waiting time. You can close the window — the connection continues on its own, and we will write when the site works.

If you changed an existing record, the old value may stay in caches for as long as its TTL was (often 1 hour, sometimes a day). This is not an error — the wizard shows “all correct, waiting”.

If a site already opens at the address#

If another site works at this address now, after changing the record visitors will start getting the new one. Before replacing the record at Cloudflare, prepare the move: If the domain already has a site. Do not want to touch the old site — connect a separate subdomain, for example menu.example.com or shop.example.com.

Email on the domain#

The domain’s email lives in MX, TXT (SPF, DKIM, DMARC) records and sometimes in a separate mail subdomain. Connecting the site does not touch them — do not delete or change them at Cloudflare. Only delete records on the name you are connecting, and only if the wizard pointed at them. More — Custom domain and email.

If the wizard shows an error#

Every wizard message leads to its own section of the errors page. The most common ones at Cloudflare:

RECORD_NAME_DOUBLED — the name was saved with the domain twice
CNAME_CONFLICT_A — an old A record is left on the same name
CLOUDFLARE_PROXIED — the proxy is on
TRAFFIC_TARGET_MISMATCH — the record points elsewhere
PROPAGATING — all correct, the record is still spreading

How to disconnect and what to delete#

Disconnect the domain in the wizard (“Disconnect domain”), then delete at Cloudflare the records it lists: the site record (CNAME or ALIAS) and, if any, the ownership and certificate records. Leave email and other records alone. While the site record points to us, the address stays reserved for your account — this protects it from being taken over by another account. The wizard checks the removal with the “Check removal” button. More — Disconnecting a custom domain.

Cloudflare specifics#

Set Cenaly records to Proxy status = DNS only (grey cloud): ownership checks and certificate issuance at our CDN do not work through the Cloudflare proxy.
New A/AAAA/CNAME records are created proxied (orange cloud) by default — you have to switch the toggle off explicitly.
Root: a CNAME on @ is allowed (CNAME flattening), but a proxied CNAME is always flattened and shows up outside as Cloudflare A/AAAA addresses.
Do not enable “Flatten all CNAMEs”: an ownership check via CNAME stops seeing the record itself.
If the domain was added to Cloudflare by a hosting partner, records are edited at that partner, not in dash.cloudflare.com.
The TTL of proxied records is Auto only (300 s); for DNS only records you can set the TTL.

Sources#

This guide is based on Cloudflare’s documentation, checked 2026-11-06. Panels change — if a button or field is labelled differently for you, follow the meaning of the step, and the wizard will tell you if the record came out wrong.