Cloudflare Proxied vs DNS Only
Proxied and DNS-Only Records Explained
Cloudflare proxied vs DNS only is a setting chosen for each DNS record. Each record can be set to proxied or DNS only. Proxied records are shown with an orange cloud, and DNS only records with a grey cloud. The setting decides whether traffic for that hostname passes through Cloudflare's network or goes straight to the address the record points to.
With a proxied record, visitors' requests reach Cloudflare first. Cloudflare can then cache responses, apply security rules and keep the origin's IP address out of public DNS lookups. With a DNS only record, the answer contains the origin's own address, so visitors connect directly, and Cloudflare handles only the DNS answer.
What Each Setting Gives You
- Caching and filtering apply only to proxied records. Traffic on a DNS only record does not pass through Cloudflare's cache or security rules.
- Origin address privacy comes from proxied records. With DNS only, anyone who looks up the name can see the origin's address.
- Some services need DNS only. Mail servers, which rely on MX records, and other non-web services usually need the direct address and cannot be proxied in the same way.
Each record is treated separately, so a domain can mix settings. The web front end can be proxied while another subdomain stays DNS only. The wider role of Cloudflare is explained in what Cloudflare does for a website.
Example: Hiding the Origin Only Partly
A shop proxies its main domain, so pages and static files benefit from caching and visitors never see the server's address in DNS. However, the server itself still accepts connections from any address. Someone who learned the address from an old DNS record, or from a leaked configuration, could reach the server directly and bypass Cloudflare's filtering.
Limiting the origin server to accept connections only from Cloudflare's published address ranges closes that gap. Proxying is a strong layer, but it works best when the origin is protected as well.
Frequently asked questions
Does the grey cloud turn off Cloudflare's protection for the whole site?
Only for the hostname that uses the DNS only record. That traffic does not pass through Cloudflare's network, so caching and filtering do not apply to it. Other records on the same domain can remain proxied, because each record is set separately.
Does proxying completely hide my server's real IP address?
No, not completely. Proxying hides the address from ordinary DNS lookups, but other sources can reveal it, such as old DNS records or mail headers. Protecting the origin so it accepts traffic only from the proxy adds a stronger safeguard. The general idea behind this is explained in reverse proxies.