Cloudflare DNS: record types and what proxying actually does

TL;DR: # DNS record types on Cloudflare ## The types you touch most - A / AAAA: point a name at an IPv4 / IPv6 address. Use for the apex and anything with a fixed IP. - CNAME: point a name at another DNS name. Cannot sit at the zone apex (use A/AAAA there, or Cloudflare's CNAME flattening behavior for the apex case). - MX: mail routing.

DNS record types on Cloudflare

The types you touch most

• A / AAAA: point a name at an IPv4 / IPv6 address. Use for the apex and anything with a fixed IP.
• CNAME: point a name at another DNS name. Cannot sit at the zone apex (use A/AAAA there, or Cloudflare's CNAME flattening behavior for the apex case).
• MX: mail routing. Always DNS-only, never proxied.
• TXT: verification strings (SPF, DKIM, domain ownership). Always DNS-only, never proxied.

Proxy eligibility

Only A, AAAA, and CNAME records that serve HTTP/HTTPS traffic can be proxied. Everything else (MX, TXT, SRV, NS) is DNS-only by nature. Cloudflare also blocks proxying some CNAME targets on purpose (other CDNs, mail verification hosts) to protect you from a misconfiguration that would break connectivity.

The failure modes

• Proxying an MX or mail-related CNAME: mail breaks. Mail records stay gray-clouded, always.
• CNAME at the apex in a naive setup: not valid DNS. Cloudflare flattens it, but know it is happening.
• A record pointing at a stale IP after a migration while the proxied CNAME looks fine: check the underlying A/AAAA, the proxy hides the origin IP from you too.

TTL

TTL controls how long resolvers cache the record, which is how long updates take to reach users. Before any migration, lower TTLs (e.g. to 300s) at least a day ahead so the cutover propagates fast, then raise them after.

Checklist

• Web traffic records: A/AAAA/CNAME, proxied.
• Mail and verification records: DNS-only.
• Before migrations: lower TTL, wait out the old TTL, then cut over.

When to use

You hit exactly this: Cloudflare DNS: record types and what proxying actually does in Cloudflare DNS.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Cloudflare DNS.

Verified against the live docs: only A/AAAA/CNAME can be proxied, MX/TXT always DNS-only, purposeful proxy blocks on some CNAME targets, TTL controls propagation time. Refs: https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/ and https://developers.cloudflare.com/dns/proxy-status/