How to Configure DNS and SSL for a Custom Domain on Cloudflare: Step-by-Step

/ Uncategorized

Setting up a custom domain with proper DNS records and free SSL on Cloudflare is one of the fastest ways to secure and accelerate your website. But between choosing the right SSL mode, configuring A records, and avoiding the dreaded redirect loops, plenty of developers hit walls that cost hours of debugging.

This practical walkthrough shows you exactly how to set up DNS and SSL on Cloudflare, with real configuration examples and the pitfalls we’ve seen crash production sites. By the end, you’ll have a working custom domain, proper DNS records, and a free SSL certificate delivering HTTPS traffic.

Why Use Cloudflare for DNS and SSL?

Before diving into the setup, here’s why Cloudflare remains the go-to choice for developers in 2026:

  • Free Universal SSL certificates deployed in minutes
  • One of the fastest DNS resolvers in the world
  • Built-in DDoS protection and CDN caching
  • Origin certificates valid for up to 15 years
  • Support for modern protocols like HTTP/3 and TLS 1.3
cloudflare dashboard

Prerequisites Before You Start

Make sure you have the following ready:

  1. A registered domain name (from any registrar: Namecheap, GoDaddy, Google Domains, etc.)
  2. Access to your domain registrar’s control panel
  3. A free Cloudflare account
  4. Your origin server’s public IP address (or the hostname your host provides)

Step 1: Add Your Domain to Cloudflare

  1. Log in to your Cloudflare dashboard.
  2. Click Add a Site and enter your root domain (e.g., example.com, without www or https://).
  3. Select the Free plan (upgrade later if you need advanced features).
  4. Cloudflare will automatically scan your existing DNS records. Review them carefully.

Point Your Nameservers to Cloudflare

Cloudflare will assign you two nameservers (something like anna.ns.cloudflare.com and bob.ns.cloudflare.com). Head to your registrar and:

  1. Locate the Nameservers section in your DNS management panel.
  2. Switch from default to Custom Nameservers.
  3. Paste the two Cloudflare nameservers exactly as provided.
  4. Save changes and wait for propagation (usually 5 minutes to 24 hours).

You’ll receive an email from Cloudflare once your domain is active.

Step 2: Configure DNS Records

Once your domain is active, go to the DNS tab in Cloudflare. Here’s how to configure the most common records.

A Record (Root Domain)

An A record points your root domain to an IPv4 address.

Type Name Content Proxy Status TTL
A @ 203.0.113.10 Proxied (orange cloud) Auto

CNAME Record (Subdomains)

CNAME records point a subdomain to another hostname. Perfect for the www subdomain or pointing to services like Netlify, Vercel, or Heroku. See https://hatchet.com.au.

Type Name Content Proxy Status
CNAME www example.com Proxied
CNAME app myapp.vercel.app Proxied

Other Records You May Need

  • MX records for email delivery (Google Workspace, Microsoft 365, etc.)
  • TXT records for SPF, DKIM, and domain verification
  • AAAA records for IPv6 addresses
  • NS records if delegating subdomains

Important: Email-related records (MX, SPF, DKIM) must always stay DNS-only (grey cloud). Proxying them will break your mail flow.

cloudflare dashboard

Step 3: Understanding Cloudflare SSL Modes

This is where most developers get tripped up. Cloudflare offers four SSL/TLS encryption modes, and choosing the wrong one causes redirect loops, mixed-content warnings, or plain HTTP errors.

Navigate to SSL/TLS > Overview in your dashboard to select a mode.

Mode Browser to Cloudflare Cloudflare to Origin When to Use
Off HTTP only HTTP only Never (unsafe)
Flexible HTTPS HTTP Only if your origin cannot serve HTTPS at all
Full HTTPS HTTPS (self-signed OK) Origin has SSL but no valid cert
Full (Strict) HTTPS HTTPS (valid cert required) Recommended for production

Why Flexible SSL Is Dangerous

Flexible SSL might seem convenient, but it creates a false sense of security. Traffic between Cloudflare and your origin travels unencrypted, which can leak sensitive data. It also commonly causes infinite redirect loops when your origin server is configured to redirect HTTP to HTTPS.

Always aim for Full (Strict) in production.

Step 4: Install a Cloudflare Origin Certificate

To use Full (Strict) mode, install a free Cloudflare Origin Certificate on your server. These certificates are valid for up to 15 years and are trusted by Cloudflare’s edge.

  1. Go to SSL/TLS > Origin Server.
  2. Click Create Certificate.
  3. Choose RSA or ECDSA (ECDSA is smaller and faster).
  4. List the hostnames the certificate should cover (e.g., *.example.com, example.com).
  5. Set the validity period (default is 15 years).
  6. Copy the certificate and private key. Store the private key securely, it’s only shown once.
  7. Install the certificate on your origin (Nginx, Apache, IIS, or your hosting provider’s SSL panel).

Example Nginx Configuration

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/ssl/certs/cloudflare-origin.pem;
    ssl_certificate_key /etc/ssl/private/cloudflare-origin.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://localhost:3000;
    }
}

Step 5: Enable Universal SSL and HTTPS Enforcement

Cloudflare automatically issues a Universal SSL certificate for your zone. To confirm:

  1. Head to SSL/TLS > Edge Certificates.
  2. Ensure Universal SSL is Active.
  3. Toggle on Always Use HTTPS to redirect all HTTP traffic to HTTPS.
  4. Enable Automatic HTTPS Rewrites to fix mixed-content issues automatically.
  5. Consider turning on HSTS once you’re confident HTTPS works everywhere (be careful, this is hard to reverse).
cloudflare dashboard

Step 6: Test Your Setup

Run these quick checks before calling it done:

  • Visit https://yourdomain.com and confirm the padlock icon appears.
  • Test http://yourdomain.com and confirm it redirects to HTTPS.
  • Run your domain through SSL Labs for a grade (aim for A or A+).
  • Check DNS propagation with dig yourdomain.com or an online DNS checker.
  • Verify subdomains (www, app, etc.) all resolve correctly.

Common Pitfalls That Cause Site Errors

1. Error 526: Invalid SSL Certificate

Happens when you use Full (Strict) but your origin doesn’t have a valid certificate. Fix by installing a proper Cloudflare Origin Certificate or switching to Full mode temporarily.

2. Redirect Loops (ERR_TOO_MANY_REDIRECTS)

Usually caused by Flexible SSL combined with an origin that also redirects HTTP to HTTPS. Switch to Full (Strict) and remove any HTTP-to-HTTPS redirects from your origin (Cloudflare handles them at the edge).

3. Orange Cloud on Mail Records

Proxying MX or mail-related A records will break email delivery. Always keep them as DNS-only (grey cloud).

4. Universal SSL Not Issuing

If SSL takes more than 24 hours to activate, check that CAA records aren’t blocking Cloudflare from issuing certificates. Remove conflicting CAA records or add letsencrypt.org and digicert.com.

5. Mixed Content Warnings

Occurs when your HTTPS pages load HTTP resources (images, scripts). Enable Automatic HTTPS Rewrites in the SSL/TLS panel and audit your codebase for hardcoded http:// URLs.

Bonus: DNS Best Practices for Developers

  • Use short TTLs (60 to 300 seconds) during migrations, then increase after stability
  • Enable DNSSEC under DNS settings for cryptographic domain integrity
  • Set up CAA records to restrict which CAs can issue certs for your domain
  • Use Cloudflare’s API tokens instead of Global API keys for automation
  • Document all records in your infrastructure repo (Terraform works great with Cloudflare)

FAQ

Is Cloudflare SSL really free?

Yes. Universal SSL is free forever on all plans, including the Free tier. Origin Certificates are also free and valid for up to 15 years.

How long does it take to activate SSL on Cloudflare?

Universal SSL typically activates within 15 minutes after your domain becomes active on Cloudflare. In rare cases, it can take up to 24 hours. See https://developers.cloudflare.com.

Do I need to keep my domain registered with a specific provider?

No. Cloudflare works with any registrar as long as you can change the nameservers. You can also transfer your domain to Cloudflare Registrar at cost price if you prefer.

What’s the difference between an A record and a CNAME?

An A record points a hostname directly to an IPv4 address. A CNAME points a hostname to another hostname, which then resolves to an IP. Use A records for root domains and CNAMEs for subdomains pointing to third-party services.

Should I use Full or Full (Strict) SSL mode?

Always aim for Full (Strict) in production. It validates your origin’s certificate, protecting against man-in-the-middle attacks between Cloudflare and your server.

Can I use Cloudflare DNS without the proxy features?

Absolutely. Set records to DNS-only (grey cloud) to use Cloudflare purely as an authoritative DNS provider without proxying traffic through their network.

What happens if I switch nameservers back?

Your DNS records revert to whatever your registrar has configured. Cloudflare’s caching, WAF, and SSL will no longer apply, so be sure your origin can handle direct traffic before switching back.

Setting up DNS and SSL on Cloudflare is straightforward once you understand the moving parts. Stick to Full (Strict) mode, use Origin Certificates, keep mail records unproxied, and you’ll have a fast, secure, and scalable setup ready for production traffic.