This article describes the purpose, benefits, and limitations of enabling a CNAME setup for a Cloudflare domain.
Overview
A CNAME setup allows a customer to maintain authoritative DNS outside of Cloudflare. It allows individual subdomains to benefit from Cloudflare's services without requiring updates for a domain's registration to point to Cloudflare's nameservers for DNS resolution.
The logical flow of a DNS lookup for a domain on a CNAME setup is shown in the diagram below:
Activating CNAME setup for a domain
1. Create a Cloudflare account and add your website
2. Upgrade the domain to a Business plan or higher as needed.
3. Go to Overview.
4. In Advanced Actions, select Convert to CNAME DNS Setup.
5. Select Convert.
5. Once you finish, add the new TXT record to your authoritative DNS.
6. After a few hours, Cloudflare will have verified the TXT record and sent a confirmation email.
7. Provision Universal SSL for the domain.
(Optional) Provision Cloudflare Universal SSL for CNAME setup
Cloudflare's Universal SSL certificate will be deployed once:
- A domain is activated on the CNAME setup
- Proper Domain Control Validation (DCV) records have been added to authoritative DNS. To change your DCV method, see Change DCV Method.
To provision a Universal SSL certificate, follow the instructions in our developer documentation.
Adding DNS records to a CNAME setup
Once a CNAME setup is enabled, DNS records must be updated in both Cloudflare's DNS app and your authoritative DNS:
1. Add an A or CNAME record in the Cloudflare DNS app for the subdomain.
2. Edit the corresponding CNAME record in your authoritative DNS to append .cdn.cloudflare.net to the hostname.
For example, when configuring www.example.com on a CNAME setup with Cloudflare, the CNAME record in authoritative DNS would need to point to www.example.com.cdn.cloudflare.net:
www.example.com CNAME www.example.com.cdn.cloudflare.net
CNAME records can be added to your authoritative DNS for each subdomain to be proxied to Cloudflare.
Limitations
The CNAME setup has two limitations:
- DDOS protection for attacks against DNS infrastructure is only available for the delegated subdomain records.
- Only subdomains, not the root domain, can use Cloudflare's services. This limitation is imposed by Internet DNS specifications.
Troubleshooting
Error caught when trying to convert the zone type. (Code: 1232)
If you encounter (Code: 1232) error while converting to CNAME setup on Cloudflare dashboard:
- Make sure that your domain is not active on another Cloudflare account.
- If your domain is active on another account, remove it from the other account and try to convert the domain on your account to CNAME setup.
- If you are not aware of any other account managing this domain, please contact Cloudflare support team for assistance.
Related resources