What you're doing and why it's painful
A CNAME record points one hostname to another — typically used to point a subdomain like app.yourdomain.com to your hosting provider's domain. It's one of the most common DNS records and one of the most commonly misconfigured.
The pain: Cloudflare's proxy mode (the orange cloud) intercepts traffic and can break services that don't support it. CNAME flattening at the apex confuses people. And Cloudflare's restriction on certain CNAMEs (like CNAME at the root, or CNAMEs for some email services) catches people off-guard.
Prerequisites
- Your domain is on Cloudflare (orange or grey cloud in the DNS tab)
- You know the target hostname your hosting provider gave you (e.g.
myapp.vercel.app)
Step 1 — Go to DNS Records
- Log in to Cloudflare Dashboard
- Select your domain
- Go to DNS → Records
- Click Add record
Step 2 — Add the CNAME record
Fill in the form:
| Field | Value |
|---|---|
| Type | CNAME |
| Name | Your subdomain — e.g. app for app.yourdomain.com |
| Target | The hostname your provider gave you — e.g. myapp.vercel.app |
| Proxy status | See below |
| TTL | Auto (default) |
Click Save.
Step 3 — Choose: Proxied or DNS-only
This is the most important decision when adding a CNAME in Cloudflare.
Proxied (orange cloud) — Cloudflare sits in front of your server
- Cloudflare caches, protects, and accelerates your traffic
- Your origin IP is hidden
- Only use this for web traffic (HTTP/HTTPS)
- Do NOT use this for email, FTP, SSH, or non-HTTP services
DNS-only (grey cloud) — Cloudflare just provides DNS resolution
- Traffic goes directly to your server without Cloudflare in the middle
- Origin IP is visible
- Required for: email delivery (MX, SPF, DKIM), some third-party services that don't support Cloudflare proxying, SSH access
Rule of thumb: If it's a website or web app, use proxied. If it's email, database, or anything non-HTTP, use DNS-only.
CNAME at the apex (root domain)
You cannot add a CNAME for your root domain (yourdomain.com itself) in standard DNS — only for subdomains. However, Cloudflare supports CNAME flattening, which allows a CNAME-like record at the apex.
To point your root domain to a hostname:
- Add a record with Type
CNAME - Set Name to
@(meaning the root) - Enter the target hostname
Cloudflare silently flattens this into an A record for DNS resolution while preserving the CNAME behaviour. Not all DNS hosts support this — it's a Cloudflare-specific feature.
Verifying the record
After saving, check propagation with:
dig CNAME app.yourdomain.com
For a proxied record, dig will return Cloudflare's IPs rather than the CNAME target — this is expected. To see the underlying CNAME, use a DNS lookup tool and set your resolver to 1.1.1.1.
You can also test the live record:
curl -I https://app.yourdomain.com
Common errors and gotchas
CNAME is not allowed on the root domain
This error appears in other DNS providers but not in Cloudflare (which supports CNAME flattening at @). If you see it, check that you're using @ as the name, not your bare domain name.
Service works locally but fails after adding CNAME Your hosting provider may require the CNAME to be added before they provision a TLS certificate for your subdomain. Follow your hosting provider's custom domain instructions — Cloudflare DNS addition is usually just one step.
HTTPS not working through Cloudflare proxy Go to SSL/TLS → Overview and set the mode to Full or Full (strict). With Flexible SSL, some origin configurations cause redirect loops.
Cloudflare proxy breaks my service Some services (e.g. certain API endpoints, email, database connections) don't work through Cloudflare's HTTP proxy. Switch the record to DNS-only (grey cloud).