Português
English
The short answer: every record in Cloudflare’s DNS has a cloud beside it. Orange (Proxied) means visitors talk to Cloudflare and Cloudflare fetches what it needs from the server. Grey (DNS only) means Cloudflare just answers the DNS question and the traffic goes straight to the server. The website goes orange; anything that is not a web page (mail, FTP, SSH) and the admin logins stay grey. Getting this wrong in a hurry is the most common reason mail stops after the move. Cloudflare is a third-party service: the account is yours, opened on their site, and we do not sell it.
Record by record
| Record | Cloud | Why |
| The domain (@) and www | Orange | This is the website: it gains caching, filtering and the certificate at the door. |
| MX | None | An MX is never proxied: it points at a name, and that name is what matters. Cloudflare does not even show the switch. |
| The name the MX points to (usually mail) | Grey | Mail uses ports and protocols the proxy does not carry. Orange, mail stops arriving and mail apps stop connecting. |
| cpanel, webmail, ftp and the e-mail setup names (autodiscover, autoconfig) | Grey | Admin and setup access: they should reach the server as they are, with no caching or challenges in the way. |
| TXT (SPF, DKIM, DMARC, verifications), CAA, SRV | None | They are information, not traffic. Copy them exactly: moving the whole zone without losing records. |
| A subdomain for a service on other ports (a streaming server, an app on a VPS) | Grey | The proxy only carries web traffic: ports 80 and 443 plus a short list of others Cloudflare publishes. Nothing else gets through. |
| A subdomain that is another site, or a web API | Orange, if you like | It behaves like the main site. Test first, especially if it receives automated calls from other systems. |
Reviewing the clouds without breaking anything
|
|
|
|
|
|
dig +short www.yourdomain
dig +short mail.yourdomain
| A grey cloud shows the server’s address, and for mail there is no way round that. Anyone who looks up mail.yourdomain sees it. Turning mail orange to “hide the IP” hides nothing: it just takes mail offline. Cloudflare’s protection is for the website, not for the whole server. |
| Changed a cloud and nothing seems to happen? Orange records get Cloudflare’s automatic TTL; grey ones use whatever you choose. Anyone who already stored the old answer keeps it until the TTL runs out: TTL and the four places to check. |
|
Mail stopped after putting the domain on Cloudflare? Tell us the domain and send a screenshot of the DNS record list there. Open a support ticket |
RECOMMENDED PRODUCT Register your .co.mz domain Secure your company name before someone else registers it. from $62.53/yr Search a domain |
