Moving DNS to Cloudflare
Chapter 3 — Moving DNS to Cloudflare
Moving your DNS to Cloudflare is the single highest-leverage change you can make to a self-hosted website. It solves the CNAME-at-apex limitation that blocked osztromok.com from using Cloudflare Tunnel, makes future changes propagate in seconds rather than hours, and adds a layer of DDoS protection — all for free. The process takes about 15 minutes and your site stays online throughout.
What this chapter covers: Why Cloudflare is worth using even on the free tier. What "moving DNS" actually means — registrar stays IONOS, only the nameservers change. The orange cloud (proxied) vs grey cloud (DNS only) — the most important concept in Cloudflare. The full migration walkthrough: adding the domain, reviewing the auto-imported records, updating nameservers at IONOS, and verifying the transfer. CNAME flattening and why it fixes the apex problem. What to expect during the transition period.
Why Move to Cloudflare?
CNAME Flattening
Cloudflare can serve a CNAME target as an A record at the root domain — something standard DNS cannot do. This is what makes Cloudflare Tunnel work on osztromok.com (not just www).
Near-instant propagation
DNS changes on Cloudflare take effect in seconds, not hours. Their global Anycast network serves the updated answer from the moment you click Save.
DDoS protection
When the orange cloud is on, your real IP is hidden behind Cloudflare's network. Attacks are absorbed at Cloudflare's edge before they reach your server — included free.
Free SSL certificates
Cloudflare issues and renews TLS certificates for your domain automatically. Visitors get HTTPS even if your origin server only serves HTTP — though properly configuring end-to-end SSL is better (Chapter 1 of the Security course).
Tunnel integration
Cloudflare Tunnel (Chapter 4) creates DNS records in your Cloudflare zone automatically when you configure a public hostname — no manual record creation needed.
Genuinely free
The free tier includes unlimited DNS queries, unlimited Tunnel usage, DDoS protection, and SSL. No credit card required. Cloudflare's business model is selling to enterprises — the free tier is a genuine product, not a trial.
What does NOT change: IONOS remains your registrar — you still pay IONOS to renew the domain each year. Your domain name stays the same. Your server stays the same. The only thing that changes is which nameservers answer DNS queries for osztromok.com.
The Orange Cloud vs Grey Cloud — The Most Important Cloudflare Concept
Every DNS record in Cloudflare has a toggle that controls whether traffic is proxied through Cloudflare or goes directly to your server. This is represented by an orange cloud icon (proxied) or a grey cloud icon (DNS only). Getting this right is the single most common source of confusion when setting up Cloudflare.
Orange Cloud — Proxied
Traffic flows through Cloudflare's network before reaching your server. DNS returns Cloudflare's IP addresses, not your real IP.
You get:
Use for: HTTP/HTTPS web traffic. A records and CNAME records for your website. Cloudflare Tunnel records (the tunnel itself handles routing).
Cannot be used for: MX records (email bypasses the proxy automatically), SSH, custom non-HTTP ports.
You get:
- DDoS protection — your real IP stays hidden
- CDN caching — static files served from Cloudflare's edge
- Free HTTPS — Cloudflare terminates SSL for you
- Firewall rules, rate limiting
Use for: HTTP/HTTPS web traffic. A records and CNAME records for your website. Cloudflare Tunnel records (the tunnel itself handles routing).
Cannot be used for: MX records (email bypasses the proxy automatically), SSH, custom non-HTTP ports.
Grey Cloud — DNS Only
Cloudflare resolves DNS but traffic goes directly to your server. DNS returns your real IP address.
You get:
Use for: Records where proxying breaks things — mail servers, FTP, non-standard ports, SSH, anything that doesn't use HTTP/HTTPS.
Always grey: NS and MX records are always grey — Cloudflare doesn't proxy these regardless of your setting.
You get:
- Fast Cloudflare DNS (still faster than most registrars)
- Near-instant propagation
- No DDoS protection — your IP is visible
- No CDN or SSL termination at Cloudflare
Use for: Records where proxying breaks things — mail servers, FTP, non-standard ports, SSH, anything that doesn't use HTTP/HTTPS.
Always grey: NS and MX records are always grey — Cloudflare doesn't proxy these regardless of your setting.
ORANGE CLOUD (Proxied) GREY CLOUD (DNS Only)
Browser → Cloudflare Edge Browser → (your real IP)
│ │
│ Encrypted tunnel │ Direct connection
▼ ▼
Your Server Your Server
dig osztromok.com → 104.21.x.x dig osztromok.com → 82.2.236.221
(Cloudflare's IP) (your real IP — visible)
For Cloudflare Tunnel: orange cloud is correct — Cloudflare
receives the request and routes it through the tunnel to your server.
For osztromok.com with Cloudflare Tunnel: the A or CNAME records for your website should be orange cloud (proxied). The tunnel only works when traffic passes through Cloudflare — that's what makes it possible to receive connections despite the Virgin Media Hub blocking inbound ports. If you accidentally set the record to grey cloud, the tunnel won't work.
The Full Migration — Step by Step
Walkthrough · Chapter 3
Move DNS for osztromok.com from IONOS to Cloudflare. Estimated time: 15–30 minutes hands-on, plus up to 24 hours for NS propagation (usually much faster).
1
Create a free Cloudflare account at cloudflare.com if you don't have one. Log in and click Add a site (or Add a domain in newer UI). Enter
osztromok.com and click Continue.
2
Select the Free plan — scroll to the bottom if you don't see it immediately. Cloudflare will show paid plans first; the free tier is fully adequate for self-hosting.
3
Cloudflare automatically scans your existing DNS records. It queries your current IONOS nameservers and imports what it finds. This usually takes 30–60 seconds. You'll then see a list of imported records to review — do not skip this step.
4
Review and correct the imported records carefully. Cloudflare's scan is good but not perfect. Check every record against what you know you have in IONOS:
— Is your A record for
— Does www exist and point correctly?
— Are any MX records for email present?
— Are there any old records that no longer apply?
— Is the proxy toggle (orange/grey) set correctly for each? (A records for your website should be orange; MX records are always grey)
Add any missing records now. Delete any that shouldn't exist. You cannot easily go back once the nameservers switch.
— Is your A record for
@ pointing to the right IP?— Does www exist and point correctly?
— Are any MX records for email present?
— Are there any old records that no longer apply?
— Is the proxy toggle (orange/grey) set correctly for each? (A records for your website should be orange; MX records are always grey)
Add any missing records now. Delete any that shouldn't exist. You cannot easily go back once the nameservers switch.
5
Cloudflare will give you two nameserver addresses — something like:
elma.ns.cloudflare.com
raj.ns.cloudflare.com
# These are unique to your account — copy the exact ones Cloudflare gives you.
Copy both of these — you'll need them in the next step.
6
Log in to IONOS and update the nameservers for osztromok.com.
In IONOS: Domains & SSL → click the domain name → Nameservers → Edit. Remove the existing IONOS nameservers and replace them with the two Cloudflare addresses from step 5. Save.
This is the critical action — you're telling the global DNS system that Cloudflare is now authoritative for osztromok.com.
In IONOS: Domains & SSL → click the domain name → Nameservers → Edit. Remove the existing IONOS nameservers and replace them with the two Cloudflare addresses from step 5. Save.
This is the critical action — you're telling the global DNS system that Cloudflare is now authoritative for osztromok.com.
7
Wait for nameserver propagation. Cloudflare will email you when it detects the NS change has propagated. This typically takes a few minutes to a few hours, occasionally up to 24 hours. Your site remains accessible throughout — the old IONOS nameservers keep answering until the cached NS records expire worldwide.
8
Verify the transfer is complete:
# Check which nameservers the world now sees for your domain
$ dig osztromok.com NS +short
elma.ns.cloudflare.com.
raj.ns.cloudflare.com.
# When both show Cloudflare nameservers, the transfer is complete.
# Verify your A record resolves correctly through Cloudflare
$ dig osztromok.com +short
104.21.x.x # Cloudflare's IP (proxied) — correct
# Or if you set it to grey cloud (DNS only):
82.2.236.221 # your real IP — also correct if intentional
After Cloudflare confirms the transfer, you manage all DNS records inside the Cloudflare dashboard. The IONOS DNS panel is no longer used — records you change there will be ignored since IONOS's nameservers are no longer authoritative.
What to Check in the Imported Records
Cloudflare's auto-scan misses some record types and occasionally imports the wrong values. Use this as a checklist during step 4 of the migration:
| Record | Proxy setting | What to verify |
|---|---|---|
| @ A record | Orange (proxied) | IP matches your server. Set orange if you want DDoS protection and CDN, grey if you need your real IP visible (e.g. for non-HTTP services on same IP). |
| www A or CNAME | Orange (proxied) | Points to your IP or to the root domain. Should match the @ record's proxy setting. |
| MX records | Always grey | Cloudflare forces MX to grey regardless — confirm the mail server hostname is correct. If you don't have email, you may not have any MX records. |
| TXT records | Always grey | SPF, DKIM, domain verification strings. Check they were all imported — TXT records are sometimes missed by the scan. |
| Cloudflare Tunnel CNAMEs | Orange (proxied) | If you already set these up in Cloudflare before the migration, they'll already be there. If not, Chapter 4 covers creating them. |
| Stale records | Remove | Old IP addresses, test subdomains, services you no longer use. Clean up now — it's easier than later. |
CNAME Flattening — How Cloudflare Solves the Apex Problem
As covered in Chapter 1, the DNS specification doesn't allow a CNAME record at the root domain (@) because the root must also have NS and SOA records, and CNAME can't coexist with them. This is why adding a CNAME for osztromok.com pointing to <tunnel-id>.cfargotunnel.com failed in IONOS.
Cloudflare solves this internally with CNAME flattening: when you create a CNAME record at the root, Cloudflare doesn't serve it as a CNAME. Instead it follows the CNAME chain internally, resolves it to an A record (an IP address), and returns that A record to resolvers. From the outside it looks like a normal A record — fully spec-compliant. But you can use CNAME targets at the root.
You add in Cloudflare:
osztromok.com. CNAME abc123.cfargotunnel.com. ← what you configure
What resolvers see:
osztromok.com. A 104.21.x.x ← what Cloudflare serves
Cloudflare resolves abc123.cfargotunnel.com internally,
finds its IP, and returns that as an A record.
The CNAME never leaves Cloudflare's system.
This is why Cloudflare Tunnel can be configured to work on the root domain osztromok.com once DNS is managed by Cloudflare, even though it couldn't work when DNS was at IONOS.
What to Expect During the Transition
Immediately after saving nameservers in IONOS: Nothing changes yet. IONOS nameservers are still answering. Your site is still accessible normally.
0–2 hours: NS records start propagating. Resolvers around the world see a mix — some return IONOS's answers, some return Cloudflare's. Both sets of records are identical (you checked them in step 4) so visitors won't notice any difference.
2–24 hours: Propagation completes globally. Cloudflare sends you a confirmation email: "Great news! Cloudflare is now protecting your site." From this point, you manage DNS entirely in Cloudflare.
After confirmation: The IONOS DNS panel still shows your old records but they're now irrelevant — changes there have no effect. Manage everything in Cloudflare's dashboard.
SSL during transition: If your site was HTTP-only before, visitors may briefly see browser warnings as Cloudflare issues a certificate. This usually happens within 15 minutes of the transfer completing. If warnings persist, check the SSL/TLS setting in Cloudflare (Dashboard → SSL/TLS → Overview) — set it to Flexible initially (HTTPS to visitors, HTTP to your server) while you set up a proper certificate on the server (covered in the Security course, Chapter 1).
Common Mistakes
- Not reviewing the auto-imported records. Cloudflare's scan is good but misses records occasionally. Skipping the review and then discovering a missing MX record two days later when email stops working is a painful experience.
- Setting MX records to orange cloud. Email doesn't work through Cloudflare's HTTP proxy. Cloudflare automatically overrides this to grey, but it's worth knowing why — you can't proxy non-HTTP traffic through the orange cloud.
- Continuing to edit records in IONOS after the transfer. Once Cloudflare's nameservers are active, changes in IONOS's DNS panel are silently ignored. All record management moves to Cloudflare.
- Forgetting that SSL/TLS mode matters. If you set a record to orange cloud but leave SSL mode on "Off" in Cloudflare, visitors get HTTP despite HTTPS being possible. If you set it to "Full (Strict)" but don't have a valid certificate on your server, connections will fail. Start with "Flexible" and upgrade to "Full (Strict)" once you have Let's Encrypt set up (Security course, Chapters 1–2).
- Panicking during propagation. If your site seems to work for some visitors but not others, that's normal — different resolvers have different cached NS records. It resolves itself as propagation completes. Don't make further changes; you'll introduce inconsistencies.
Quick Reference — Chapter 3
| Task / Command | Purpose / Notes |
|---|---|
| dig osztromok.com NS +short | Check which nameservers are authoritative — Cloudflare names confirm transfer is complete |
| dig osztromok.com +short | If proxied (orange), returns Cloudflare's IP. If DNS-only (grey), returns your real IP. |
| dig osztromok.com @elma.ns.cloudflare.com +short | Query Cloudflare's nameserver directly — confirms your records as Cloudflare sees them |
| Orange cloud (proxied) | Use for: A/CNAME records for HTTP/HTTPS websites, Cloudflare Tunnel CNAMEs |
| Grey cloud (DNS only) | Use for: MX (always), mail servers, FTP, SSH, any non-HTTP service |
| CNAME flattening | Cloudflare's automatic feature — lets you use CNAME at the root domain by resolving it internally to an A record |
| SSL/TLS → Flexible | Safe starting point after migration — HTTPS to visitors, HTTP to origin server. Upgrade to Full (Strict) after setting up Let's Encrypt. |
| Cloudflare dashboard → DNS | Where all record management happens after migration. IONOS DNS panel is no longer used. |