You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/dns/proxy-status/index.mdx
+89-5Lines changed: 89 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,13 +3,97 @@ pcx_content_type: navigation
3
3
title: Proxy status
4
4
sidebar:
5
5
order: 7
6
+
label: Overview
6
7
group:
7
-
hideIndex: true
8
-
label: Proxying
8
+
label: Proxy status
9
9
---
10
10
11
-
Refer to the following sections to learn more about proxying with Cloudflare DNS.
11
+
import { Render, Example, Details, GlossaryTooltip } from"~/components";
12
12
13
-
import { DirectoryListing } from"~/components";
13
+
While your [DNS records](/dns/manage-dns-records/) are used to make your website or application available to visitors and other web services, the **Proxy status** of a DNS record is used to define how Cloudflare treats incoming traffic to that record.
14
14
15
-
<DirectoryListing />
15
+
The records you can proxy through Cloudflare are [IP resolution records](/dns/manage-dns-records/reference/dns-record-types/#ip-address-resolution) — meaning A, AAAA, or CNAME records.
16
+
17
+
Cloudflare recommends setting to proxied all A, AAAA, and CNAME records that are used for serving web traffic. For example, CNAME records being used to verify your domain for a third-party service should not be proxied.
18
+
19
+
:::note
20
+
Proxying is on by default when you onboard a domain via the dashboard.
21
+
:::
22
+
23
+
### Benefits
24
+
25
+
When you set a DNS record to **Proxied**, Cloudflare can:
26
+
27
+
- Protect your origin server from [DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/).
28
+
-[Optimize, cache, and protect](/fundamentals/setup/manage-domains/connect-your-domain/#domain-configurations) all requests to your application.
29
+
- Apply your configurations for a variety of Cloudflare products.
30
+
31
+
:::caution
32
+
When you [add a domain](/fundamentals/setup/manage-domains/add-site/) to Cloudflare, Cloudflare protection will be in a [pending state](/dns/zone-setups/reference/domain-status/) until we can verify ownership. This could take up to 24 hours to complete. Refer to [Limitations](/dns/proxy-status/limitations/#pending-domains) for further guidance.
33
+
:::
34
+
35
+
### Example
36
+
37
+
<Renderfile="proxy-status-dns-table" />
38
+
39
+
This means that:
40
+
41
+
- an HTTP/HTTPS request to the proxied record `blog.example.com` will be answered with a Cloudflare [anycast IP address](/fundamentals/concepts/cloudflare-ip-addresses/) instead of `192.0.2.1`, which allows the [benefits listed above](#benefits) to take place.
42
+
- an HTTP/HTTPS request to the DNS-only record `shop.example.com` will be answered with the actual origin IP address, `192.0.2.2`. In addition to exposing your origin IP address and not benefitting from several features, Cloudflare cannot provide analytics on those requests.
43
+
44
+
For further context, refer to [How Cloudflare works](/fundamentals/concepts/how-cloudflare-works/).
45
+
46
+
---
47
+
48
+
## Proxied records
49
+
50
+
The sections below describe specific behaviors and expected outcomes when you have DNS records set to <GlossaryTooltipterm="proxy status">proxied</GlossaryTooltip>. There may also be some [limitations](/dns/proxy-status/limitations/) in specific scenarios.
51
+
52
+
### Predefined time to live
53
+
54
+
55
+
By default, all proxied records have a time to live (TTL) of **Auto**, which is set to 300 seconds.
56
+
57
+
Since only [IP resolution records](/dns/manage-dns-records/reference/dns-record-types/#ip-address-resolution) can be proxied, this setting ensures that queries to your domain name resolve fairly quickly. This setting also means that any changes to proxied A, AAAA, or CNAME records will take place within five minutes or less.
58
+
59
+
:::note
60
+
It may take longer than five minutes for you to actually experience record changes, as your local DNS cache may take longer to update.
61
+
:::
62
+
63
+
### Mix proxied and unproxied
64
+
65
+
If you have multiple A or AAAA records on the same name and at least one of them is proxied, Cloudflare will treat all A or AAAA records on this name as being proxied.
In this example, all traffic intended for `blog.example.com` will be treated as if both records were **Proxied**.
78
+
79
+
</Example>
80
+
81
+
</Details>
82
+
83
+
### Protocol optimization
84
+
85
+
For proxied records, if your domain has [HTTP/2 or HTTP/3 enabled](/speed/optimization/protocol/), Cloudflare automatically generates corresponding [HTTPS Service (HTTPS) records](/dns/manage-dns-records/reference/dns-record-types/#svcb-and-https) on the fly. HTTPS records allow you to provide a client with information about how it should connect to a server upfront, without the need of an initial plaintext HTTP connection.
86
+
87
+
:::note
88
+
Both HTTP/2 and HTTP/3 configurations also require that you have an SSL/TLS certificate served by Cloudflare. This means that disabling [Universal SSL](/ssl/edge-certificates/universal-ssl/), for example, could impact this behavior.
89
+
:::
90
+
91
+
---
92
+
93
+
## DNS-only records
94
+
95
+
When an A, AAAA, or CNAME record is **DNS-only** — also known as being gray-clouded — DNS queries for these will resolve to the record's normal IP address, as described in the [example](#example).
In addition to potentially exposing your origin IP addresses to bad actors and [DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/), leaving your records as **DNS-only** means that Cloudflare cannot [optimize, cache, and protect](/fundamentals/concepts/how-cloudflare-works/) requests to your application or provide analytics on those requests.
This page describes expected limitations for DNS records <GlossaryTooltipterm="proxy status">proxy status</GlossaryTooltip>.
11
+
This page describes expected limitations when <GlossaryTooltipterm="proxy status">proxying DNS records</GlossaryTooltip>. For further context, refer to [How Cloudflare works](/fundamentals/concepts/how-cloudflare-works/).
0 commit comments