The Cloudflare proxy: orange cloud, mail, and real visitor IPs
Which DNS records you should and should not proxy, why proxying mail breaks it, and what happens to your logs and caching once the orange cloud is on.
In the Cloudflare DNS screen every record has a cloud icon. Orange means the traffic is proxied through Cloudflare; grey means Cloudflare only answers the DNS query and the visitor connects to your server directly. Which records you proxy matters more than most people expect.
Never proxy mail
MX records cannot be proxied at all, and the hostname an MX record points at must be grey. Proxying it sends mail to Cloudflare, which does not run a mail server, and delivery fails.
Keep these grey:
- Anything an MX record points to
- mail., webmail., smtp., imap. and similar hostnames
- FTP, SSH and anything on a non-web port
Cloudflare's proxy only carries HTTP and HTTPS. A service on any other port stops working the moment you turn its record orange.
Your logs will show Cloudflare's IPs
Once a record is proxied, every request reaches your server from a Cloudflare address. Server logs, analytics and any IP-based rule now see Cloudflare instead of the real visitor. The original address is passed in the CF-Connecting-IP header.
This has a sharp edge worth knowing: security tools that ban by IP can ban Cloudflare itself, and because all your traffic now arrives from those few addresses, that takes the whole site off-line rather than one abuser. If you run fail2ban or similar on a VPS, configure it to read the real IP from that header before you enable the proxy.
Caching, and why your change is not showing
Cloudflare caches static files at its edge. After you update CSS, JavaScript or images, visitors can keep receiving the old version. Use Purge Cache in Cloudflare, and Development Mode while actively working on a site to bypass the cache temporarily.
If a change still will not appear after purging, check your own browser cache before assuming Cloudflare is at fault — it is the more common culprit.
A sensible default
Proxy the website records (@ and www) and leave everything else grey. That gives you the caching and protection you came for without putting mail or administrative access at risk. If you are unsure about a specific record, ask us from the Support section before switching it.