October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
VGSources
Blog

How to Point a Cloudflare Domain to Your VPS

A complete, step-by-step guide to pointing a Cloudflare domain at a VPS, including DNS records, nameserver delegation, DNSSEC, proxy modes, HTTPS, verification, and troubleshooting.
Length9 min Posted Quest giverVGSources Team
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To point a Cloudflare-managed domain at a VPS, add the domain to Cloudflare, create DNS records for the VPS address (or its hostname), switch the registrar to Cloudflare’s assigned nameservers, then choose whether web traffic should be proxied through Cloudflare or sent directly to the server. Preserve existing mail and verification records, handle DNSSEC in the correct order, and configure HTTPS and the VPS web server before testing.

Understand what must be changed

Two separate settings determine whether a domain reaches your VPS:

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • DNS records identify the destination. An A record maps a name to an IPv4 address, an AAAA record maps it to an IPv6 address, and a CNAME maps it to another hostname.
  • Nameserver delegation determines which DNS provider is authoritative. Replacing the registrar’s current nameservers with Cloudflare’s assigned nameservers makes Cloudflare the authoritative DNS provider for the domain.

Changing only a DNS record does not make Cloudflare authoritative if the registrar still delegates the domain elsewhere. Conversely, changing nameservers without creating the correct A, AAAA, or CNAME records leaves Cloudflare with no usable destination.

Cloudflare describes the resulting arrangement this way: “After you connect your domain to Cloudflare, Cloudflare will act as the reverse proxy and DNS provider for your site.” Whether it actually acts as a reverse proxy for a particular hostname depends on that record’s proxy setting.

#1 Best Overall
Sale
Gaoye Blue Light Blocking Glasses
  • BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
  • EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
  • COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
  • LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
  • WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

Before you start

Have these details ready:

  • Access to the account at the domain registrar, because nameserver delegation is changed there rather than in the Cloudflare dashboard.
  • The VPS provider’s current IPv4 address, IPv6 address if available, or the hostname supplied by the provider.
  • The hostnames you intend to serve, such as the root domain (example.com), www.example.com, or an application hostname such as app.example.com.
  • Access to the VPS web-server and application configuration so it can answer requests for the domain’s Host header.
  • A plan for HTTPS: proxied hostnames can use Cloudflare’s edge certificate, while DNS-only hostnames require a valid certificate installed and maintained on the VPS.

If the domain already handles email, verification, or another service, first inventory its existing DNS records. Mail-related MX and TXT records, service-discovery records, and verification records must survive the move to Cloudflare.

Add the domain to Cloudflare

  1. In Cloudflare, add the domain as a site and choose the full DNS setup. Cloudflare will present the DNS records it found during onboarding.
  2. Review every imported record before changing nameservers. Confirm that MX records, mail-policy TXT records, domain-verification records, and records for other services are present and have the expected values.
  3. Correct or add records in Cloudflare’s DNS section. Use the root name for the apex domain and a label such as www or app for a subdomain.
  4. Keep a copy of the old DNS zone until the new delegation has been verified. This gives you a reference if a service stops resolving after the switch.

Cloudflare’s DNS-record guidance was updated May 6, 2026. The exact record content still comes from your VPS or other hosting provider, so do not substitute an address from an old invoice, a control panel screenshot, or a previous server.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create the record that points to the VPS

Choose the record type according to what the VPS provider supplied.

Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)
  • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
  • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
  • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
  • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
  • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Record type Use it when What the value is Typical name
A The VPS has an IPv4 address The VPS’s current IPv4 address The root name for example.com, or a label such as www or app
AAAA The VPS has an IPv6 address The VPS’s current IPv6 address The same hostname that should be reachable over IPv6
CNAME The provider gives you a hostname instead of an address The provider’s hostname A subdomain such as www or app

When to use A and AAAA together

Create an A record when IPv4 is available. Add an AAAA record when the VPS also has IPv6 and the service is configured to accept IPv6 traffic. Publishing an AAAA record for an address that is not routed, allowed through the firewall, or configured in the web server can make some visitors fail even though IPv4 works.

When a CNAME is appropriate

Use a CNAME when the hosting provider gives you a hostname and expects you to follow that hostname. A CNAME is not an alternative spelling for an IP address: it points to a hostname, which is then resolved separately. Follow the provider’s required target exactly.

Root domain and subdomains

For the apex, create the record for the root name represented by your Cloudflare interface; the resulting address should answer for example.com. For a subdomain, use its label: www produces www.example.com, and app produces app.example.com. Create records for each hostname you actually intend to serve rather than assuming one record covers every name.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men
  • Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
  • Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
  • Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
  • ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
  • Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

Choose Proxied or DNS only

Cloudflare gives web records two traffic modes. The orange-cloud Proxied setting sends supported HTTP and HTTPS requests through Cloudflare’s edge. The gray-cloud DNS only setting returns the destination record directly, so clients connect to the VPS without Cloudflare in the request path.

Consideration Proxied (orange cloud) DNS only (gray cloud)
Traffic path Client connects to Cloudflare; Cloudflare connects to the VPS origin Client resolves the record and connects directly to the VPS
Cloudflare edge services Available for supported web traffic Not in the traffic path
Origin address exposure The VPS address is not returned as the web destination through the proxied record The VPS address is returned directly
Certificate responsibility Cloudflare can provide an edge certificate for the proxied hostname; the origin connection must still match the selected SSL/TLS configuration A valid certificate must be installed and renewed on the VPS
Non-HTTP services and mail Do not proxy records unless the service specifically supports it Use this mode for services that must resolve directly, including ordinary mail records

For a normal website, proxy the web A, AAAA, or CNAME record if you want Cloudflare’s edge services. Keep MX and other mail records DNS only. If an application uses a protocol or port that Cloudflare does not proxy, DNS only may be required for that hostname.

Replace the registrar’s nameservers

  1. Open Cloudflare’s onboarding details for the zone and copy the two nameservers assigned to the domain.
  2. At the registrar, find the domain’s nameserver or DNS-delegation settings and replace the existing authoritative nameservers with both Cloudflare nameservers.
  3. Save the change exactly as shown. A spelling error, missing nameserver, or change made to a different domain prevents the zone from activating.
  4. Return to Cloudflare and wait for it to detect the delegation. Cloudflare’s onboarding documentation covers this nameserver replacement and the related SSL/TLS setup.

Handle DNSSEC in the right order

If DNSSEC is enabled at the registrar or current DNS provider, disable it before changing nameservers. An old DS record combined with new nameservers can make validating resolvers reject the zone. After Cloudflare becomes authoritative, DNSSEC can be enabled again through Cloudflare if your registrar and setup support it. The safe sequence is therefore: disable existing DNSSEC, change nameservers, confirm Cloudflare activation, then configure DNSSEC through the new authoritative provider.

Rank #4
Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack
  • Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
  • Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
  • 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
  • Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
  • USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

Configure HTTPS for the selected traffic path

Proxied hostname

A proxied hostname can use Cloudflare’s edge certificate. In Cloudflare’s SSL/TLS settings, select a mode that matches how the origin accepts HTTPS. The VPS still needs to accept the connection Cloudflare makes to it; a certificate or TLS configuration that conflicts with the selected mode produces an SSL error even though the browser can reach Cloudflare.

DNS-only hostname

When the record is gray-cloud DNS only, the browser connects to the VPS itself. Install a certificate for the requested hostname on the VPS, configure the web server to present it, and maintain its renewal. Cloudflare cannot supply an edge certificate for a connection that bypasses its edge.

Test each hostname separately. A certificate for example.com does not automatically prove that www.example.com or app.example.com is configured correctly.

Best Value
Sale
HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs
  • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
  • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
  • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
  • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
  • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Prepare the VPS web server and firewall

DNS only directs traffic; it does not configure the server. Before testing the public site:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Configure the web server’s virtual host or site definition for the exact domain and subdomain names you created.
  • Ensure the application recognizes the requested Host header and does not fall back to a default site.
  • Allow inbound TCP ports 80 and 443 in the VPS firewall and any provider-level firewall when the site uses HTTP and HTTPS.
  • Make sure the web server listens on the address families you published. If you publish an AAAA record, IPv6 must be routed, permitted, and handled by the server.
  • Confirm that redirects, canonical-host settings, and application URL settings use the public hostname rather than an old address.

With proxying enabled, the origin sees connections from Cloudflare rather than ordinary visitor addresses. The server must therefore accept Cloudflare’s origin connections and use the requested hostname to select the correct site.

Verify the change after activation

  1. Check that Cloudflare shows the zone as active and that the registrar displays the two assigned Cloudflare nameservers.
  2. Resolve the root domain and each subdomain you created. Confirm that A results match the current VPS IPv4 address, AAAA results match the current IPv6 address, and CNAME results point to the intended provider hostname.
  3. Check that MX, TXT, and verification records still resolve. Send and receive a test message if the domain handles mail.
  4. Open the site over HTTP and HTTPS. Confirm that the intended certificate is presented, the expected application loads, and the server does not show a different virtual host.
  5. Repeat the checks from more than one network or resolver when possible. A local resolver can retain an older answer after another resolver has updated.

Troubleshoot common failures

NXDOMAIN or “domain does not exist”

  • Confirm that the domain was added and activated in Cloudflare.
  • At the registrar, verify that both assigned Cloudflare nameservers are present and that no old delegation remains in place.
  • Check the record name. A record for app does not answer for the root domain, and a typo creates a different hostname.
  • Make sure the required record exists in the active Cloudflare zone. Cloudflare warns that missing records can cause DNS errors.

The old site still appears

  • Compare the current A and AAAA values with the VPS provider’s current addresses. An outdated address can send visitors to the previous server.
  • Check whether the resolver is still caching the old answer. TTL controls how long resolvers may retain a response, so updates do not reach every user at the same moment.
  • On the VPS, verify the virtual host for the requested Host header. The correct IP can still display the wrong site when the web server falls back to its default configuration.
  • Check both A and AAAA records. A working IPv4 site can appear broken to visitors whose networks prefer an incorrect IPv6 destination.

SSL or certificate errors

  • For DNS only, install and renew a certificate on the VPS for every hostname being served.
  • For Proxied, verify Cloudflare’s SSL/TLS mode and make sure the origin accepts the connection type selected there.
  • Confirm that the web server presents the certificate for the requested hostname rather than a default certificate for another site.

Mail stopped working

  • Restore the correct MX records and the TXT records used for mail authentication or service verification.
  • Keep mail records DNS only unless the mail service specifically supports proxying. Ordinary mail delivery does not use the web reverse-proxy path.
  • Check that the nameservers now authoritative for the domain contain the same mail destinations as the previous provider.

Changes appear slowly

There is no single guaranteed propagation interval. Resolver caches honor the TTL attached to DNS responses, and different resolvers refresh at different times. Check the authoritative configuration and TTL first; do not repeatedly edit a correct record simply because one network still has an older cached answer.

A practical setup sequence

For most websites, this order minimizes avoidable outages:

  1. Record the existing DNS zone and identify mail, verification, and service records.
  2. Add the domain to Cloudflare with the full DNS setup and review the imported records.
  3. Create the VPS A record, add AAAA when IPv6 is genuinely configured, or use the provider’s CNAME when it supplies a hostname.
  4. Decide whether each web hostname should be Proxied or DNS only. Leave mail and unsupported services DNS only.
  5. Disable existing DNSSEC, then replace the registrar’s nameservers with Cloudflare’s two assigned nameservers.
  6. After activation, configure HTTPS for the selected mode and confirm the VPS web server, application, and firewall settings.
  7. Verify DNS answers, the live site, certificates, and mail from independent networks or resolvers.
  8. Only after the checks pass, remove obsolete records or retire the old server.

This sequence separates authority, destination, traffic handling, and origin configuration. When something fails, that separation makes the cause identifiable: nameserver errors affect the whole zone, record errors affect a hostname, proxy settings change the traffic path, and VPS configuration determines what the origin actually serves.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.