This article describes the purpose, benefits, and limitations of enabling a CNAME setup for a Cloudflare domain.

Overview

A CNAME setup allows a customer to maintain authoritative DNS outside of Cloudflare.  It allows individual subdomains to benefit from Cloudflare's services without requiring updates for a domain's registration to point to Cloudflare's nameservers for DNS resolution.  

The logical flow of a DNS lookup for a domain on a CNAME setup is shown in the diagram below:

Activating CNAME setup for a domain

Review our guide that explains the benefits and limitations of a CNAME setup

1. Create a Cloudflare account and add your website

2. Upgrade the domain to a Business plan or higher as needed.

3. Contact Cloudflare Support to request allowance of a CNAME setup for a specific domain.  Mention CNAME setup for <domain> in the subject line.

4. Cloudflare Support will confirm the CNAME setup has been enabled.

5. A TXT record will appear in the Cloudflare DNS app under the Verification TXT Record section.  Add the TXT record to your authoritative DNS.

6. After a few hours, Cloudflare will have verified the TXT record and sent a confirmation email.

7. Provision Universal SSL for the domain.

(Optional) Provision Cloudflare Universal SSL for CNAME setup

Cloudflare's Universal SSL certificate will be deployed once a domain is activated on the CNAME setup and proper Domain Control Validation (DCV) records have been added to authoritative DNS:

1. Fetch DCV records from the Cloudflare API or via the Cloudflare dashboard:
   • Log in to your Cloudflare account and select the appropriate domain.
   • Click the SSL/TLS app.
   • Click the Edge Certificates tab.
   • Under Edge Certificates, click on the certificate where the Type is Universal and Status is Pending Validation to view the Certificate validation request and Certificate validation response information.
2. Complete the certificate process. The default method for CNAME setups is HTTP.
3. Add DNS records for the CNAME setup

Adding DNS records to a CNAME setup

Once a CNAME setup is enabled, DNS records must be updated in both Cloudflare's DNS app and your authoritative DNS:

1. Add an A or CNAME record in the Cloudflare DNS app for the subdomain.

2. Edit the corresponding CNAME record in your authoritative DNS to append .cdn.cloudflare.net to the hostname.

For example, when configuring www.example.com on a CNAME setup with Cloudflare, the CNAME record in authoritative DNS would need to point to www.example.com.cdn.cloudflare.net:

www.example.com CNAME www.example.com.cdn.cloudflare.net

CNAME records can be added to your authoritative DNS for each subdomain to be proxied to Cloudflare.

Limitations

The CNAME setup has two limitations:

1. DDOS protection for attacks against DNS infrastructure is only available for the delegated subdomain records.
2. Only subdomains, not the root domain, can use Cloudflare's services. This limitation is imposed by Internet DNS specifications.

Related resources

• Managing DNS records in Cloudflare
• What is Domain Control Validation (DCV)
• Changing DCV method