# Proxy status: proxied vs DNS-only

The proxy status controls whether HTTP/HTTPS traffic for a record routes through Cloudflare's network or goes straight to your origin.

- **Proxied** (orange cloud): Cloudflare sits between visitors and your server, optimizing, caching, and protecting. Your WAF rules, caching, and redirect rules apply.
- **DNS-only** (gray cloud): Cloudflare answers DNS with your server's real IP and does not touch the HTTP traffic.

## When to proxy

All A, AAAA, and CNAME records serving web traffic: the site, the app, API endpoints over HTTP/HTTPS. You get DDoS protection, caching, and WAF.

## When to stay DNS-only

- Mail records (MX and friends).
- Non-HTTP services: SSH, databases, custom TCP/UDP (proxying those needs Spectrum, not the standard proxy).
- CNAMEs that prove domain ownership or point at verification hosts.
- Anything where the client must validate your origin IP directly.

## The gotcha everyone hits

On a proxied record, your origin sees Cloudflare IPs as the source of every request, not the visitor's IP. Anything doing auth, rate limiting, or geolocation by source IP breaks silently. Cloudflare passes the real visitor IP in the `CF-Connecting-IP` and `X-Forwarded-For` headers: configure the origin to read those (or use the mod_cloudflare / restore-visitor-IP integrations).

## Checklist

- After flipping a record to proxied, confirm the origin reads `CF-Connecting-IP`.
- If a record refuses to proxy, check the proxying limitations page before forcing it: some targets are blocked deliberately.
- Non-standard ports or non-HTTP protocols on a proxied record will not work; that is Spectrum territory.