Cloudflare basics for clients

What Cloudflare is, what we use it for, what it means for your domain and DNS, and what you need to know as a client.

If we've mentioned "pointing your domain to Cloudflare" or "managing your DNS through Cloudflare," you might be wondering what Cloudflare is and why we use it. This guide gives you a plain-English overview.

Quick summary

Cloudflare is a web infrastructure company we often use to manage DNS, add a security and performance layer in front of your website, and issue free SSL certificates. When your domain uses Cloudflare's nameservers, Cloudflare sits between your visitors and your web server — speeding things up and filtering out threats.

What Cloudflare is

Cloudflare is a large technology company that provides a range of services around internet performance and security. For most of our clients, we use Cloudflare for:

DNS management — a fast, reliable place to manage your domain's DNS records
CDN (Content Delivery Network) — caching your site content at servers near your visitors for faster load times
Security — filtering malicious traffic, blocking attacks, and protecting your server
SSL/HTTPS — providing free SSL certificates and ensuring connections to your site are encrypted
Domain registration — some clients register their domains directly with Cloudflare Registrar for at-cost pricing

Cloudflare has a generous free tier that covers everything most small and medium businesses need.

How Cloudflare works with your domain

When your domain uses Cloudflare's nameservers:

Visitors type your domain into their browser.
DNS points the request to Cloudflare's servers.
Cloudflare's servers handle the request — serving cached content where possible, and passing the request to your hosting server if needed.
Your server sends the response back through Cloudflare to the visitor.

Cloudflare acts as a "middleman" (technically called a reverse proxy) between your visitors and your hosting server. Your server's actual IP address is hidden behind Cloudflare's IP addresses.

The orange cloud vs grey cloud

In Cloudflare's DNS settings, A, AAAA and CNAME records have a proxy switch, shown as a small cloud icon:

Proxied (orange cloud) — traffic goes through Cloudflare's network, which gives you caching, DDoS protection and Cloudflare's other security features. Visitors are answered with Cloudflare's IP addresses rather than your server's.
DNS only (grey cloud) — Cloudflare answers with your server's actual IP address and doesn't route traffic through its network.

For the A and CNAME records that serve your website, we normally use Proxied. Records that exist only to prove domain ownership to another service stay on DNS only. Other record types can't be proxied at all: Cloudflare says only A, AAAA and CNAME records can be proxied, and everything else — MX and TXT records included — is always DNS only.

Orange cloud means the traffic goes through Cloudflare; grey cloud means it goes directly to your server. Only A, AAAA and CNAME records have the switch. An MX record never does, but the hostname it points to still has to be on the grey cloud, or mail can break.

Read this as text

In Cloudflare’s DNS settings an A, AAAA or CNAME record carries a small cloud icon, and that setting decides the route the traffic takes.

For website A records and CNAMEs we typically use the orange cloud (proxied), and traffic then goes through Cloudflare. Someone visiting your website reaches Cloudflare first; Cloudflare caches content where possible, passes the request on to your web server if needed, and the response travels back out through Cloudflare to the visitor.

An MX record has no cloud icon to set: it is always DNS only. Cloudflare is then used only for the DNS lookup, with no proxying, so the email goes from the sender to your mail server and bypasses Cloudflare.

One catch: the hostname an MX record points to is usually an A record of its own, and that one does have a cloud icon. Cloudflare says the mail hostname has to be on the grey cloud too, because mail clients cannot connect to a proxied address.

The reason for the difference is that Cloudflare only proxies web traffic (HTTP/HTTPS) — it cannot proxy email. Cloudflare says only A, AAAA and CNAME records can be proxied, so MX and TXT records are always answered directly and there is nothing to switch.

What Cloudflare means for DNS propagation

One benefit of Cloudflare is that record changes take effect quickly. Cloudflare says changes or additions you make to your zone take effect globally within five minutes, and usually much less. The catch is caching: if the old record had a long TTL, resolvers may keep serving the old answer until that TTL expires.

Switching your nameservers to Cloudflare is a separate, slower step. Cloudflare asks you to allow up to 24 hours for your registrar to publish the new nameservers.

Cloudflare and email

Cloudflare's proxy handles web traffic (HTTP/HTTPS). By default it does not proxy email traffic on port 25 (SMTP), so mail goes straight to your mail server. MX records have no proxy switch in Cloudflare and are always answered directly.

There is one thing to watch. If your MX record points to a hostname on your own domain, such as mail.yourdomain.com, that hostname has its own A record — and that one does have a proxy switch. Cloudflare says it has to be set to DNS only, because mail software can't connect to a proxied address. Cloudflare's own words: "Your MX record itself is always DNS-only, but the hostname it points to must also resolve to a DNS-only target." If your email runs on Google Workspace or Microsoft 365, your MX records point at their servers, not yours, so there's nothing on your side to set.

Giving us access to your Cloudflare account

We can manage your DNS, security rules, and other settings if you give us access. See Give us access to your Cloudflare account for step-by-step instructions.

The access account to use is support@chykalophia.com, unless your project lead has specified a different address.

Common questions

Is Cloudflare the same as my domain registrar?

Not necessarily. Cloudflare can act as your domain registrar (through Cloudflare Registrar) or it can just manage DNS while your domain is registered elsewhere. It's common to have a domain registered at Namecheap with nameservers pointing to Cloudflare for DNS management.

Will using Cloudflare make my site faster?

For most sites, yes — Cloudflare's CDN caches content closer to visitors, and their network is optimized for speed. The improvement varies based on where your visitors are located and how much content can be cached.

Can I use Cloudflare if I have Google Workspace email?

Yes. Cloudflare works with Google Workspace, Microsoft 365 and any other email provider — Cloudflare even publishes its own guide to adding Google Workspace DNS records. You just add your provider's MX records in Cloudflare's DNS panel. There's nothing to toggle: MX records are always DNS only.

Does Cloudflare add costs?

Cloudflare's free plan covers everything most clients need. Paid plans add more advanced security and performance features, which we may recommend for specific situations.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.