Connecting a domain from Cloudflare

Cloudflare specifics

Cloudflare is both a registrar and a DNS provider, and it has a couple of behaviours worth knowing before you connect. Sign in, choose your domain and open the DNS → Records tab. You'll add the same two records as anywhere else — an A record on the root and a CNAME on www — using the targets from your Avago domain settings. The differences are how Cloudflare handles the root record and its proxy.

CNAME flattening

DNS rules don't allow a CNAME on the root domain, but plenty of hosts want one there. Cloudflare solves this with CNAME flattening: you can enter a CNAME on the root and Cloudflare automatically resolves it to an IP behind the scenes, returning a valid A-record answer to the world. In practice:

• For the root, the A record Avago provides works directly.
• If you'd rather point the root at a hostname, Cloudflare's flattening lets you, and serves it correctly.

Either approach is fine; the A record is the simplest.

Proxied vs DNS-only

This is the setting that trips people up. Each Cloudflare record has an orange-cloud (Proxied) or grey-cloud (DNS only) toggle:

• Proxied routes traffic through Cloudflare's network and masks the real target.
• DNS only passes visitors straight through to Avago.

While you're connecting and waiting for SSL to issue, set both records to DNS only (grey cloud). Cloudflare's proxy can interfere with the domain-validation check Let's Encrypt uses, so leaving it on can block your certificate.

Once the site is live and SSL is issued, you can switch the proxy back on if you want Cloudflare's caching — but only after the certificate exists. Turning it on too early is the usual reason a Cloudflare connection gets stuck.