Cloudflare for SaaS custom hostnames: fallback origin and apex limits

TL;DR: # Cloudflare for SaaS: custom hostnames Cloudflare for SaaS extends your Cloudflare security and performance to customer-owned domains: your customers add their hostname to your zone as a custom hostname, and their traffic routes through your configuration to your origin. ## Fallback origin Custom hostnames route to a fallback origin: the default origin server for hostnames that do not match a more specific route.

Fix

1. Set it before onboarding customers; it is the safety net that answers when a hostname has no dedicated origin configured. Expected: this specific failure stops.

2. Available on all plans. ## The apex limitation Customers typically point their domain at you with a CNAME, but DNS forbids CNAME at the apex. Expected: this specific failure stops.

3. Supporting customer apex domains requires apex proxying, an Enterprise add-on (or BYOIP on Enterprise). Expected: this specific failure stops.

4. Plan for this in pricing conversations before a customer asks "why can't I use my root domain". ## Onboarding sequence 1. Expected: this specific failure stops.

5. You verify the hostname status is active before sending them traffic. Expected: this specific failure stops.

Details

2. Customer completes domain control validation (DNS record at their provider). 3. 4.

When to use

You hit exactly this: Cloudflare for SaaS custom hostnames: fallback origin and apex limits in Cloudflare for SaaS custom hostnames.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Cloudflare for SaaS custom hostnames.

Edge cases

• Customer adds the custom hostname in your flow (API or dashboard).
• Monitor: a customer who breaks their validation record later degrades silently. ## Checklist - Fallback origin configured and answering correctly before the first customer. - Validation status checked programmatically for every hostname; alert on anything not active. - Document the apex story for customers up front.

Verified against the live Cloudflare for SaaS doc (updated Apr 29, 2026): custom hostnames route to fallback origin, available on all plans, apex proxying is an Enterprise add-on, DNS providers that disallow apex CNAME. Ref: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/