Description

Ensure A, AAAA, and CNAME records for web traffic (HTTP and HTTPS) have their Proxy status set to Proxied (orange cloud). Records for services that cannot be proxied, such as mail servers or non-HTTP ports, can stay DNS only.

Rationale

When a record is DNS only (grey cloud), visitors connect directly to your origin server, so its IP address is public and Cloudflare's WAF, DDoS protection, and caching do not apply. Proxying web records hides the origin IP and sends all traffic through Cloudflare's security and performance features.

Impact

  • Origin IP addresses are hidden

  • Web traffic is protected by Cloudflare's WAF and DDoS protection

  • Non-HTTP services must stay DNS only, or they will stop working

Default Value

When you add a new A, AAAA, or CNAME record in the dashboard, the proxy is on by default, but it can be turned off per record.

Pre-Requisites

  • Cloudflare account with Administrator or DNS permissions for the zone

  • A list of records that serve web traffic

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Review the Proxy status column for A, AAAA, and CNAME records.

  5. If a record that serves web traffic shows DNS only, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Select Edit on the record.

  5. Switch Proxy status to Proxied and select Save.

  6. Confirm that the website still loads correctly.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Select Edit on the record, switch Proxy status to DNS only, and select Save.

Reference