The single most important setting.
THE ORANGE CLOUD
In the Cloudflare DNS panel, each record has a cloud icon.
Orange means proxied: traffic flows through Cloudflare.
Grey means DNS only: Cloudflare answers the lookup and traffic goes straight to us.
WHAT SHOULD BE PROXIED
The record for your website: the root domain and www.
That is where caching, filtering and protection apply.
WHAT MUST NOT BE PROXIED
Mail records. Cloudflare does not proxy mail, and proxying the hostname mail points to breaks sending and receiving. FTP and SSH hostnames cPanel access hostnames Any subdomain used for a service other than web traffic
THE MOST COMMON CLOUDFLARE FAULT
Mail stops working after moving to Cloudflare, because the mail record was proxied along with everything else.
Set it to DNS only and mail returns.
CHECKING
Look at the cloud icon on every record. Anything not serving web pages should be grey.
WHY IT MATTERS FOR SSL
AutoSSL validation fails against a proxied record in some configurations, which is why certificates fail to issue after moving to Cloudflare.
