Cloudflare for SaaS custom hostnames: fallback origin and apex limits

Cloudflare for SaaS: custom hostnames

Cloudflare for SaaS extends your Cloudflare security and performance to customer-owned domains: your customers add their hostname to your zone as a custom hostname, and their traffic routes through your configuration to your origin.

Fallback origin

Custom hostnames route to a fallback origin: the default origin server for hostnames that do not match a more specific route. Set it before onboarding customers; it is the safety net that answers when a hostname has no dedicated origin configured. Available on all plans.

The apex limitation

Customers typically point their domain at you with a CNAME, but DNS forbids CNAME at the apex. Supporting customer apex domains requires apex proxying, an Enterprise add-on (or BYOIP on Enterprise). Plan for this in pricing conversations before a customer asks "why can't I use my root domain".

Onboarding sequence

1. Customer adds the custom hostname in your flow (API or dashboard).
2. Customer completes domain control validation (DNS record at their provider).
3. You verify the hostname status is active before sending them traffic.
4. Monitor: a customer who breaks their validation record later degrades silently.

Checklist

• Fallback origin configured and answering correctly before the first customer.
• Validation status checked programmatically for every hostname; alert on anything not active.
• Document the apex story for customers up front.

Verified against the live Cloudflare for SaaS doc (updated Apr 29, 2026): custom hostnames route to fallback origin, available on all plans, apex proxying is an Enterprise add-on, DNS providers that disallow apex CNAME. Ref: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/