Cloudflare DNS cheat sheet with proxy rules, TTL notes, CNAME flattening, mail records, and a local record checker
Cloudflare DNS record check Paste DNS rows, zone-file lines, or API JSON to generate a report.
Routes supported web records through Cloudflare so visitors see Cloudflare edge addresses instead of your origin.
Use it for HTTP or HTTPS traffic on A, AAAA, and CNAME records when you want CDN, WAF, cache, Workers, redirects, or DDoS protection. Do not use it for mail or arbitrary TCP service discovery records.
A www 203.0.113.10 Proxied Auto
Publishes the DNS answer directly without sending traffic through Cloudflare.
Keep MX, TXT, CAA, SRV, NS, SOA, and most verification records DNS-only. Also use DNS-only temporarily when debugging origin reachability or protocol issues that Cloudflare proxying can mask.
MX @ 10 mail.example.com DNS-only 300
Lets Cloudflare manage cache duration, especially for proxied records whose public answer is Cloudflare edge infrastructure.
For proxied records, Auto TTL is the normal daily setting. For DNS-only cutovers, set a short explicit TTL before the migration so resolvers stop caching the old target quickly.
CNAME www example.pages.dev Proxied Auto
Cloudflare can accept a CNAME-like target at the zone apex and answer clients with address records.
This is provider behavior, not portable zone-file syntax. It is useful for SaaS targets at example.com, but exports and imports still deserve review because another DNS provider may reject the same shape.
CNAME @ my-site.hosting.example Proxied Auto
Point a hostname to IPv4 or IPv6 addresses; these are the most common Cloudflare proxy candidates.
Use A for IPv4 and AAAA for IPv6. If the record is proxied, Cloudflare hides the origin address from normal DNS answers; if DNS-only, the address is published directly.
A api 203.0.113.20 Proxied Auto
Alias a subdomain to another hostname, commonly for SaaS, Pages, load balancers, and CDNs.
A CNAME name normally cannot also have TXT, MX, A, or AAAA records at the same name. Move verification TXT to the exact name the vendor asks for, or use a different subdomain.
CNAME docs cname.vercel-dns.com Proxied Auto
A record such as *.example.com catches otherwise undefined first-level subdomains.
Wildcards do not override an exact record. Use them carefully with proxying because a broad wildcard can accidentally expose preview apps or route unknown hostnames to the wrong origin.
CNAME * fallback.example.net Proxied Auto
MX routes inbound mail and points to mail exchanger hostnames, not Cloudflare proxied web origins.
Never orange-cloud MX. The MX target should be a hostname with address records, and mail setup should be paired with SPF, DKIM, and DMARC TXT records.
MX @ 10 aspmx.l.google.com DNS-only 3600
SPF is a TXT value starting with v=spf1; publishing two policies on the same name causes receiver-side errors.
When adding a sender, merge include mechanisms into the existing SPF record instead of creating a second TXT. Also watch the SPF 10-DNS-lookup limit as vendors pile up.
TXT @ "v=spf1 include:_spf.google.com include:sendgrid.net ~all" DNS-only 300
DKIM stores public keys on selector names, while DMARC publishes policy at _dmarc.
Keep both DNS-only. Start DMARC with p=none while collecting reports, then move gradually toward quarantine or reject after every sender aligns.
TXT _dmarc "v=DMARC1; p=none; rua=mailto:dmarc@example.com" DNS-only 300
CAA tells certificate authorities which issuers may create certificates for the domain.
Use CAA when you want tighter certificate issuance control. Include the CA used by Cloudflare Universal SSL and any external CA your team actually uses, or renewals can fail.
CAA @ 0 issue "letsencrypt.org" DNS-only 3600
DNSSEC signs DNS answers; Cloudflare can host signed zones, but the registrar DS record must match.
Turn it on after delegation is stable, then copy the DS record to the registrar. Mismatched or stale DS records cause validation failures that look like the domain vanished.
Registrar DS must match the Cloudflare DNSSEC panel
Cloudflare becomes authoritative only after the registrar points the domain to the assigned Cloudflare nameservers.
Do not invent nameserver hostnames or reuse names from another zone. Copy the exact two assigned nameservers, and keep the previous DNS provider unchanged until delegation is observed globally.
Registrar NS: ada.ns.cloudflare.com, max.ns.cloudflare.com
Cloudflare can import common zone-file syntax, but provider-specific pseudo records deserve manual review.
Review apex aliases, flattened CNAMEs, provider verification TXT, and records with unusual quoting. After import, compare record counts and inspect every mail-related row before changing nameservers.
www 300 IN CNAME example.pages.dev.
Lower DNS-only TTL before a migration, verify the new target, then raise it again after the change is stable.
A TTL of 300 seconds is a common operating value before cutover. Very long TTLs on DNS-only A, AAAA, CNAME, or MX records make rollback and traffic shifts slower than expected.
A @ 203.0.113.10 DNS-only 300
A proxied hostname can still leak the origin through sibling DNS records, old history, mail records, or direct hostnames.
Use separate origins when possible, lock origin firewall rules to Cloudflare egress ranges, and avoid publishing origin-only hostnames like origin.example.com unless access is restricted.
Do not leave origin.example.com as DNS-only if it points to the same protected host
When a change looks wrong, compare Cloudflare authoritative answers with public recursive resolver answers.
Authoritative answers show what Cloudflare is serving now; recursive answers show what users may still receive from cache. Mismatches are expected until TTLs expire.
dig @ada.ns.cloudflare.com www.example.com A +short
A dense browser-only Cloudflare DNS cheatsheet for developers and ops teams who edit DNS records in daily work. Search Cloudflare-specific notes for proxied versus DNS-only records, Auto TTL, CNAME flattening, apex records, wildcards, MX/SPF/DKIM/DMARC, CAA, DNSSEC, nameserver delegation, and zone-file import/export syntax. Paste DNS records copied from the Cloudflare dashboard, Cloudflare API JSON, or a simple zone-file export and the local checker flags common mistakes before you save: proxied MX/TXT records, duplicate SPF policies, CNAME mixed with other record types, long migration TTLs, and unsafe apex assumptions. Nothing is uploaded or queried; the page is a static reference with copy-ready snippets and clear warnings for production changes.
Paste or drop your content into the tool panel.
Click the button. All processing is local in your browser.
Copy the result or download to disk in one click.
Use it before upload, handoff, archive, support review, or any moment where a file needs one local check before it leaves your machine.
These links move the current task into a more complete workflow.
You paste a few rows copied from the DNS dashboard before a deploy. The checker identifies record types, proxy state, TTL choices, and risk warnings such as a proxied MX or a CNAME mixed with a TXT on the same name. That gives the reviewer a concise note before the change goes live.
Before moving www or the apex to a new origin, search for TTL, proxying, CNAME flattening, and apex behavior in one place. The reference reminds you to lower DNS-only TTLs ahead of time, keep mail records DNS-only, and use the correct apex pattern rather than assuming every DNS provider behaves like Cloudflare.
A new sending vendor asks for SPF, DKIM, and DMARC records. Search the mail section, copy the example shape, and paste the current TXT rows into the checker to catch duplicate SPF records before DMARC starts failing alignment.
Turning on the orange cloud for MX, TXT, SRV, CAA, NS, or SOA records. Those records should be DNS-only; only web-facing A, AAAA, and CNAME records are normal proxy candidates.
Publishing two SPF TXT records on the same name after adding a mail vendor. Merge all senders into one v=spf1 policy or receivers can return SPF PermError.
Treating Cloudflare CNAME flattening as portable zone-file syntax. The apex behavior is provider-specific; export/import workflows still need careful review.
The checker runs locally and does not call Cloudflare, DoH, or any external API. Pasted DNS rows can contain origin IP addresses, internal service names, and verification tokens, so the input is not persisted or placed in shareable URL state.
Folks in your role tend to reach for these alongside this tool.