Setting up a Cloudflare proxy DNS setup puts a layer between your server and the rest of the world, and the best part: it costs nothing. If you self-host WordPress, a mail server, or anything from home, your IP is probably out there, visible to anyone with a scanner and bad intentions. Cloudflare can fix that in five minutes.
What is the Cloudflare DNS proxy?
First, the basics: DNS (Domain Name System) is the phonebook of the Internet. It translates names like mrappz.com into IP addresses that machines understand, as Cloudflare explains in their documentation. When you configure your DNS records in Cloudflare and activate the orange cloud, something interesting happens: Cloudflare stops being a simple translator and becomes a reverse proxy that intercepts all traffic before it reaches your server.
This means that when someone visits your website, they don’t reach your machine. They reach Cloudflare, and Cloudflare forwards the request to your server. Your real IP stays hidden. For the visitor, everything works normally. For your server, it’s like having a free bodyguard.
Why your self-hosted server needs it
Here’s what a Cloudflare proxy DNS setup gives you without asking for anything in return:
IP hiding: your real IP address disappears from the public map. Port scans, direct access attempts to your machine, all of that hits Cloudflare’s infrastructure, not your home router.
DDoS protection: if someone tries to flood your server with junk traffic, Cloudflare absorbs it. They have the network capacity to handle attacks that would take down any home connection or modest VPS.
Automatic SSL/TLS: Cloudflare manages the HTTPS certificate for you. Your server can communicate securely with Cloudflare without you having to renew certificates every three months, though you can do that if you want end-to-end encryption.
Built-in CDN: static content from your website (images, CSS, JS) gets cached on Cloudflare’s edge servers distributed worldwide. If someone visits from Argentina, they don’t have to wait for the packet to travel from Spain.
Firewall rules: the free plan includes basic WAF (Web Application Firewall) rules. You can block bots by country, by user-agent, by path. Enough to stop most automated noise.
Orange cloud vs grey cloud: the difference that changes everything
In Cloudflare’s DNS panel, each record has a cloud icon next to it. Orange means proxied (processed by Cloudflare). Grey means DNS only (DNS resolution only, no proxy). This distinction is crucial for a proper Cloudflare proxy DNS setup.
Web records (A, AAAA, CNAME for your main domain) should have the orange cloud enabled. That activates all the protection. But there are records you should not proxy. Your mail MX record, for example, doesn’t work well through Cloudflare’s proxy on the free plan. TXT records for verification, DKIM, SPF, and DMARC go in grey.
We already covered this when setting up ProtonMail with a custom domain: mail records go in DNS only mode, and web records go proxied. Mixing them up brings trouble.
Step-by-step configuration
1. Create a Cloudflare account and add your domain. Cloudflare will scan your current DNS records and import what it finds.
2. Review the imported records. Make sure your A record points to your server’s IP. Enable the orange cloud on web records. Leave mail records (MX, TXT for SPF/DKIM/DMARC) in grey.
3. Change your nameservers at your registrar (Namecheap, Cloudflare Registrar, or whichever you use) to the ones Cloudflare assigns you. This can take up to 24-48 hours to propagate, though it’s usually much faster.
4. Configure SSL mode. In SSL/TLS > Overview, select Flexible if your server doesn’t have its own certificate, or Full if you already have Let’s Encrypt. Full (strict) is ideal if you have a valid certificate.
5. Enable “Always Use HTTPS” in SSL/TLS > Edge Certificates. This automatically redirects all HTTP traffic to HTTPS.
6. Review firewall rules. In Security > WAF you can add custom rules. For example, block traffic from certain countries or challenge suspicious bots with CAPTCHA.
What a Cloudflare proxy DNS setup does NOT do for you
It’s not all roses. There are important limitations you should know about:
No protection for non-HTTP ports. If you expose an SSH service, MQTT, or a database on a port, Cloudflare won’t cover it. The proxy works for web traffic (HTTP/HTTPS) on standard ports. For other services you’d need Cloudflare Tunnel, which is a different story (and maybe another post).
The free plan caps uploads at 100 MB. If you serve large downloads, Cloudflare will cut them off. You’ll need to disable the proxy on that subdomain or upgrade to a paid plan.
Your real IP can leak if you send email directly from your server. Email headers reveal the origin IP. That’s why I use ProtonMail and SMTP2Go for transactional email: the server IP never surfaces through that channel.
Some services break with the proxy. APIs that validate the client IP, webhooks expecting direct connections, certain realtime protocols… they can cause issues. The solution is usually to create a non-proxied subdomain for those cases.
Is it worth it? Absolutely
A Cloudflare proxy DNS setup is one of those tools that seem too good to be free. And they are. You get DDoS protection, CDN, SSL, IP hiding, and basic firewall without paying a cent. If you self-host anything, not enabling it is like leaving your front door open with a sign that says “interesting stuff in here”.
Setup takes ten minutes. The benefits last forever. And if you ever need more, paid plans scale with additional features. But for 90% of self-hosters, the free plan is more than enough.
On mrappz.com I already use it, and it’s part of the reason my server can live peacefully behind a shield that costs nothing.
Disclaimer: part of the content in this post was generated with AI, but it has been reviewed and edited by me.
